Locality-Based Action-Poisoning Attack against the Continuous Control of an Autonomous Driving Model

Round 1

Reviewer 1 Report

The paper presents an insightful exploration of the vulnerability of Multi-Agent Reinforcement Learning (MARL) to the proposed "locality-based action poisoning attack" in the context of autonomous driving models. The study delves into the potential risks associated with disruptive actions performed by a single agent within a MARL system, showcasing a significant impact on the overall driving stability of the agents.

Here are some suggestions for the Authors:

1. The paper acknowledges limitations in investigating specific types of attack methods. Consider conducting a more comprehensive analysis that encompasses various attack scenarios and risks relevant to autonomous driving models.

2. In the conclusion section, summarize the key contributions and insights gained from the study. Emphasize the practical implications and potential directions for future research in securing MARL-based autonomous driving models.

Author Response

Dear Reviewer,

Thank you for your insightful and comprehensive review of our research. Your advice has provided us with the opportunity to improve the quality of our paper. We have addressed and revised the points you raised, as detailed below:

1. As you suggested, we have added to the last paragraph of the Discussion section to include a more diverse range of attack types and risks related to autonomous driving models. We have emphasized the need for addressing these aspects.

2. In the final three paragraphs of the Conclusion section, we summarized the main contributions and insights of our study. We have highlighted that our research could serve as a tool for analyzing potential risks in MARL-based autonomous driving models in the future.

 I would greatly appreciate it if you could review the above-mentioned updates. *

Dear Reviewer,

Thank you for your insightful and comprehensive review of our research. Your advice has provided us with the opportunity to improve the quality of our paper. We have addressed and revised the points you raised, as detailed below:

1. As you suggested, we have added to the last paragraph of the Discussion section to include a more diverse range of attack types and risks related to autonomous driving models. We have emphasized the need for addressing these aspects.

2. In the final three paragraphs of the Conclusion section, we summarized the main contributions and insights of our study. We have highlighted that our research could serve as a tool for analyzing potential risks in MARL-based autonomous driving models in the future.

 I would greatly appreciate it if you could review the above-mentioned updates.(

Dear Reviewer,

Thank you for your insightful and comprehensive review of our research. Your advice has provided us with the opportunity to improve the quality of our paper. We have addressed and revised the points you raised, as detailed below:

1. As you suggested, we have added to the last paragraph of the Discussion section to include a more diverse range of attack types and risks related to autonomous driving models. We have emphasized the need for addressing these aspects.

2. In the final three paragraphs of the Conclusion section, we summarized the main contributions and insights of our study. We have highlighted that our research could serve as a tool for analyzing potential risks in MARL-based autonomous driving models in the future.

 I would greatly appreciate it if you could review the above-mentioned updates in manuscript.

Reviewer 2 Report

This paper discusses attacks on Continuous Control models in the context of Autonomous Driving using Multi-Agent Reinforcement Learning (MARL). The proposed attack is called a “locality-based action poisoning attack,” which aims to disrupt model training performance by causing one target agent to perform actions that violate certain rules. The main goal is the development of attack methods enabling research to systematically evaluate the security of Autonomous Driving models that use Multi-Agent Reinforcement Learning (MARL). By testing models through attack scenarios, research can be useful for identifying potential vulnerabilities and security risks that may occur in the real world. Overall this paper has been written in a good structure, but there are several suggestions that might be taken into consideration, namely:

1. To make it easier for novice readers, perhaps in section 1 it is necessary to briefly touch on real-world problems before discussing more technical ones and their practical benefits.

2. It is better to describe the overall flow of the method before discussing the method in more detail.

3. It is necessary to explain the various types of attacks that are possible, and why the focus of this research is only on those mentioned, it is necessary to explain the focus in more detail.

4. In section 5.2 it is stated that there is a measurement of average episode reward, but there is no specific information about average episode reward in the discussion of the results. Even though this may not be the focus of measurement, it should be used as accompanying data.

5. It would be good to provide a summary of the results in section 6, the strengths and weaknesses of the proposed method and if possible compare it with other methods.

Author Response

Dear Reviewer,

I sincerely thank you for your meticulous and insightful review. Your feedback has provided me with an opportunity to thoroughly re-examine and enhance the quality of my paper in various aspects. Following your suggestions, I have made the revisions. The details are as follows :

1. In the Introduction, we added a section emphasizing the potential risks associated with autonomous driving models in complex and continuously changing real-world scenarios. Specifically, we noted that if a model is poisoned by adversarial attacks and learns wrong behavior patterns, the potential risks could significantly increase. This addition should make it easier for novice readers to connect with and understand the real-world implications of our study.

2. To clarify the overall flow, we added the first two paragraphs of Chapter 4, explaining the intent of the attack and the attacker's motivations, making it easier for readers to understand.

3. In the Introduction, we emphasized the necessity of this research, highlighting the importance of security studies as the adoption of MARL in critical areas such as autonomous driving becomes more prevalent. This clarification provides a clearer context for our approach.

4. Although we measured the average episode reward and observed its trends, we found it to be trivial and similar to the success rate graph. Hence, we focused more on explaining the existing experimental data and excluded the average episode reward from the evaluation metrics. However, to convey the training objectives of the model more clearly, we felt it necessary to describe how the rewards were set during training, which we added to the experimental settings.

5. We summarized the main contributions and insights of our research in the results section, and in the final paragraph, we provided its weaknesses, highlighting issues that need careful consideration in future research.

I would be very grateful if you could review these changes in the manuscript.

Reviewer 3 Report

My Minor editorial comments on the manuscript are as follows:

In the article, the authors focused on the MARL method. Perhaps it is worth mentioning whether other training methods are used in the issue under consideration? Describe what these methods are and their advantages and disadvantages. Authors propose a novel attack method called the "locality-based action poisoning attack" to evaluate the vulnerability of autonomous driving models. It is related to the safety issues. The issue of safety in relation to autonomous vehicles is very important. However, the article should emphasize the main purpose of the research conducted. It is also necessary to describe the possibility of their implementation in the process of improving autonomous vehicles. In related to the experimental description, there is the following question: How the success rate, crash rate, out rate, and average episode reward were defined? It may be worth describing them. The authors mentioned the use of Reynolds' rules. This is a flock algorithm - how does this algorithm relate to the considered cases of Intersection, Roundabout, and Bottleneck, on which each vehicle can move in a different direction (this is normal and not a disturbance)? The authors conducted a discussion of the presented results, pointing out the main limitations arising from the adopted research methodology and assumed technologies. The conclusion also outlines directions for further work. In Figure 3, 4, 5 where the experimental results are presented, the image quality should be improved. The description of the axes and the legends describing the individual lines are poorly readable.

Page 2 line 70/71 – no description of the symbols in the equation (1)

Page 6 line 245/246 – In the equation, not all symbols are explained

Page 11 Figure 3 and Page 12 Figure 4  and Page 13 Figure 5 -  poor figure quality - illegible descriptions of axes and legends

Author Response

Dear Reviewer,

I am deeply grateful for your insightful suggestions and thorough review, including aspects of journal formatting. Your feedback has significantly helped in enhancing the overall quality of the paper. The amendments made in response to your points are as follows:

1. To emphasize the main purpose and necessity of the research, the Introduction now addresses the problems that can arise when autonomous driving models are actually poisoned by adversarial attacks (such as training incorrect behavior patterns, leading to increased accident risks). We also emphasized the importance of these issues as MARL becomes more prevalent in safety-critical areas such as autonomous driving.

2. While Reynolds' rules might seem applicable only in environments where all agents move in the same direction, our experiments showed that agents performing actions significantly different from their neighbors can disrupt the training. This is possibly due to the increased complexity and interference in the agents' effective response to unpredictable actions of the target agent in a multi-agent interactive training environment. This analysis has been added to the last paragraph of the Experimental results.

3. Figures 3, 4, and 5 each contain six smaller images, which may be difficult to discern due to format limitations in LaTeX. Although increasing their size is challenging within the LaTeX format, we plan to explore alternative solutions. Meanwhile, to improve readability and interpretation of the experimental results, descriptions of the axes of the graphs have been added in the Experimental results section.

4. An explanation of the symbols used in Equation (1) now has been provided.

5. An explanation of the symbols used in Equation (3) now has been provided.

6. To facilitate understanding of the graphs, descriptions of the axes and what they represent have been added to the Experimental results.

I would greatly appreciate it if you could review these updates in the manuscript.

Round 2

Reviewer 2 Report

The paper has been revised properly, acceptable