Diffusion Policy Attacker: Crafting Adversarial Attacks for Diffusion-based Policies

Yipu Chen*, Haotian Xue*, Yongxin Chen

@Georgia Tech

NeurIPS 2024

TLDR: We propose algorithms that can effectively attack diffusion-based policies. 

🤖  ➡️ 👿

[arxiv] [code]

Abstract: Diffusion models (DMs) have emerged as a promising approach for behavior cloning (BC). Diffusion policies (DP) based on DMs have elevated BC performance to new heights, demonstrating robust efficacy across diverse tasks, coupled with their inherent flexibility and ease of implementation. Despite the increasing adoption of DP as a foundation for policy generation, the critical issue of safety remains largely unexplored. While previous attempts have targeted deep policy networks, DP used diffusion models as the policy network, making it ineffective to be attacked using previous methods because of its chained structure and randomness injected. In this paper, we undertake a comprehensive examination of DP safety concerns by introducing adversarial scenarios, encompassing offline and online attacks, and global and patch-based attacks. We propose DP-Attacker, a suite of algorithms that can craft effective adversarial attacks across all aforementioned scenarios. We conduct attacks on pre-trained diffusion policies across various manipulation tasks. Through extensive experiments, we demonstrate that DP-Attacker has the capability to significantly decrease the success rate of DP for all scenarios. Particularly in offline scenarios, DP-Attacker can generate highly transferable perturbations applicable to all frames. Furthermore, we illustrate the creation of adversarial physical patches that, when applied to the environment, effectively deceive the model.

• Physical Patched Attacks (Offline - Untargeted)

• Global Attacks (Online - Targeted - Target=1's)

• Global Attacks (Online - Untargeted)

• Global Attacks (Offline - Targeted - Target = 1's)

• Global Attacks (Offline - Untargeted)

• With larger attack budget, we can fully control the robots action. The following uses attack parameters: eps=0.05, N=50, sigma=0.002. We first show the attacked frames.

Rollouts: