Adversarially Robust Decision Transformer

Decision Transformer (DT), as one of the representative Reinforcement Learning via Supervised Learning (RvS) methods, has achieved strong performance in offline learning tasks by leveraging the powerful Transformer architecture for sequential decision-making. However, in adversarial environments, these methods can be non-robust, since the return is dependent on the strategies of both the decision-maker and adversary. Training a probabilistic model conditioned on observed return to predict action can fail to generalize, as the trajectories that achieve a return in the dataset might have done so due to a suboptimal behavior adversary. To address this, we propose a worst-case-aware RvS algorithm, the Adversarially Robust Decision Transformer (ARDT), which learns and conditions the policy on in-sample minimax returns-to-go. ARDT aligns the target return with the worst-case return learned through minimax expectile regression, thereby enhancing robustness against powerful test-time adversaries. In experiments conducted on sequential games with full data coverage, ARDT can generate a maximin (Nash Equilibrium) strategy, the solution with the largest adversarial robustness. In large-scale sequential games and continuous adversarial RL environments with partial data coverage, ARDT demonstrates significantly superior robustness to powerful test-time adversaries and attains higher worst-case returns compared to contemporary DT methods.

Paper

Similar papers

Peer review

Reviewer p4QE6/10 · confidence 3/52024-07-13

Summary

The paper tackles the worst-case-aware RL problem, revises the conventional DT formulation via minimax returns, and proposes the adversarial robust DT to enhance robustness against test-time adversaries.

Strengths

- The formulation of adversarial robust DT with minimax return is sound and clear. - Improving the robustness against test-time adversaries is critical for real-world deployment of RL. - The highlight and superiority of the proposed method is verified by comprehensive experiments.

Weaknesses

- Two additional returns-to-go networks are needed for return re-labeling, which increases the computation burden. - The trade-off between robustness to adversaries and the policy conservativeness is not discussed.

Questions

- Can the ARDT be compared to baselines regarding the normal case, not only the worst case. It could be interesting to see the performance drop in the normal case, and judge where it is worth sacrificing the performance in conventional cases for the improvement in the worst case. - Are there any real-world applications where it is necessary to consider a worst-case-aware RL algorithm? It could further highlight the significance of the proposed method if some examples could be provided.

Rating

6

Confidence

3

Soundness

3

Presentation

3

Contribution

3

Limitations

- The application to real-world scenarios could be limited to some extent, as the learned policy might be too conservative.

Reviewer 18ip5/10 · confidence 3/52024-07-14

Summary

This paper introduces Adversarial Robust Decision Transformer (ARDT), a novel approach enhancing robustness in sequential decision-making. ARDT aligns policies with worst-case scenarios learned through minimax expectile regression, outperforming DT in robustness against powerful adversaries across different data coverage scenarios, including sequential games.

Strengths

1 The paper's motivation seems good and well-founded, and the idea is considered novel and presented clearly and intriguingly. 2 The experimental results demonstrate better robustness compared to existing DT and ESPER methods.

Weaknesses

1 Several attacks on reinforcement learning have been proposed, such as [1][2], why have these not been applied in experimental settings? 2 There have been some related works on robust reinforcement learning, for example [3][4][5]. The authors should provide a comprehensive literature review on the topic of robust reinforcement learning, including similarities, differences, and reasons why it has not been used as a baseline for experimental comparisons. [1] Optimal Attack and Defense for Reinforcement Learning, AAAI 2024 [2] Understanding the Limits of Poisoning Attacks in Episodic Reinforcement Learning, IJCAI 2022 [3] Towards Robust Offline Reinforcement Learning under Diverse Data Corruption, ICLR 2024 [4] Survival Instinct in Offline Reinforcement Learning, NeurIPS 2024 [5] Robust Reinforcement Learning through Efficient Adversarial Herding, arXiv

Questions

see weaknesses

Rating

5

Confidence

3

Soundness

3

Presentation

2

Contribution

3

Limitations

This paper does not consider randomness, whereas random attacks are common in the real world. The authors have already clarified this limitation in the paper.

Reviewer 18ip2024-08-12

I have read the rebuttal and I will keep my score.

Authorsrebuttal2024-08-12

Thank you for acknowledging our rebuttal! Could you please confirm whether we have addressed all your concerns? Specifically, we would appreciate your feedback on whether the misunderstanding regarding random attacks has been clarified, and the related additional experimental results (Figure 3) in the rebuttal PDF is clear and sensible to you.

Reviewer 18ip2024-08-13

The rebuttal clarifies my questions on random attacks. My recommendation is based on my overall evaluation of the work.

Authorsrebuttal2024-08-13

Thank you very much for the reply. We are glad that we managed to clarify and answer all the concerns.

Reviewer JwFn6/10 · confidence 3/52024-07-17

Summary

This paper consider zero-sum two player Markov game that involves a protagonist and an adversary. The protagonist aims to maximize reward while the adversary aims to minimize it. This paper proposes Adversarial Robust Decision Transformer(ARDT), which is an algorithm that is based on Decision Transformer architecture, and learns the minimax return to go through expectile regression, hence guarantee robustness. Conduct various experiments to validate its algorithm.

Strengths

First to explore the robusteness of reinforcement learning via supervised learning. Great presentation, great novelty. Exhaustive experiement details.

Weaknesses

Lack of ablation study. e.g. how \alpha can effect the performance? It seems when \alpha is closer to 1, the learned return to go is closer to the maximum conditioned value, the more robustness the algorithms should present. It would be more solid to say expetile regression is valid if the experiment can show this phenonmenon. Like what the author stated in the paper, the environment is all deterministic. It would be great if the experiment can show the algorithm can handle stochastic environment. line 156 "estiation" to estimation line 196 "deatils" to "details"

Questions

Updating \omega and \nu happens when another is frozen. Is there any theoretical guarantee this type of update rule can converge to optimal value?

Rating

6

Confidence

3

Soundness

3

Presentation

4

Contribution

3

Limitations

The author stated one of their limitations regarding experiments. add experiment that has stochastic transtions if time permit. Add one more experiment that varies the hyperparameter \alpha to show the effectiveness of expectile regression.

Reviewer p4QE2024-08-10

Thank the authors for their detailed response, which has addressed most of my concerns.

Authorsrebuttal2024-08-13

Thank you for your positive response. We are glad that the concerns have been addressed.

Reviewer JwFn2024-08-13

Thanks for your explanation and further experiments. It address my concerns and I have add one more point to the rating.

Authorsrebuttal2024-08-13

Thank you for your response and increasing the score. We are pleased that we have been able to clarify and answer all your concerns.

Program Chairsdecision2024-09-25

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC