---
_id: '10666'
abstract:
- lang: eng
  text: Adversarial training is an effective method to train deep learning models
    that are resilient to norm-bounded perturbations, with the cost of nominal performance
    drop. While adversarial training appears to enhance the robustness and safety
    of a deep model deployed in open-world decision-critical applications, counterintuitively,
    it induces undesired behaviors in robot learning settings. In this paper, we show
    theoretically and experimentally that neural controllers obtained via adversarial
    training are subjected to three types of defects, namely transient, systematic,
    and conditional errors. We first generalize adversarial training to a safety-domain
    optimization scheme allowing for more generic specifications. We then prove that
    such a learning process tends to cause certain error profiles. We support our
    theoretical results by a thorough experimental safety analysis in a robot-learning
    task. Our results suggest that adversarial training is not yet ready for robot
    learning.
acknowledgement: M.L. and T.A.H. are supported in part by the Austrian Science Fund
  (FWF) under grant Z211-N23 (Wittgenstein Award). R.H. and D.R. are supported by
  Boeing and R.G. by Horizon-2020 ECSEL Project grant no. 783163 (iDev40).
article_processing_charge: No
arxiv: 1
author:
- first_name: Mathias
  full_name: Lechner, Mathias
  id: 3DC22916-F248-11E8-B48F-1D18A9856A87
  last_name: Lechner
- first_name: Ramin
  full_name: Hasani, Ramin
  last_name: Hasani
- first_name: Radu
  full_name: Grosu, Radu
  last_name: Grosu
- first_name: Daniela
  full_name: Rus, Daniela
  last_name: Rus
- first_name: Thomas A
  full_name: Henzinger, Thomas A
  id: 40876CD8-F248-11E8-B48F-1D18A9856A87
  last_name: Henzinger
  orcid: 0000-0002-2985-7724
citation:
  ama: 'Lechner M, Hasani R, Grosu R, Rus D, Henzinger TA. Adversarial training is
    not ready for robot learning. In: <i>2021 IEEE International Conference on Robotics
    and Automation</i>. ICRA. ; 2021:4140-4147. doi:<a href="https://doi.org/10.1109/ICRA48506.2021.9561036">10.1109/ICRA48506.2021.9561036</a>'
  apa: Lechner, M., Hasani, R., Grosu, R., Rus, D., &#38; Henzinger, T. A. (2021).
    Adversarial training is not ready for robot learning. In <i>2021 IEEE International
    Conference on Robotics and Automation</i> (pp. 4140–4147). Xi’an, China. <a href="https://doi.org/10.1109/ICRA48506.2021.9561036">https://doi.org/10.1109/ICRA48506.2021.9561036</a>
  chicago: Lechner, Mathias, Ramin Hasani, Radu Grosu, Daniela Rus, and Thomas A Henzinger.
    “Adversarial Training Is Not Ready for Robot Learning.” In <i>2021 IEEE International
    Conference on Robotics and Automation</i>, 4140–47. ICRA, 2021. <a href="https://doi.org/10.1109/ICRA48506.2021.9561036">https://doi.org/10.1109/ICRA48506.2021.9561036</a>.
  ieee: M. Lechner, R. Hasani, R. Grosu, D. Rus, and T. A. Henzinger, “Adversarial
    training is not ready for robot learning,” in <i>2021 IEEE International Conference
    on Robotics and Automation</i>, Xi’an, China, 2021, pp. 4140–4147.
  ista: 'Lechner M, Hasani R, Grosu R, Rus D, Henzinger TA. 2021. Adversarial training
    is not ready for robot learning. 2021 IEEE International Conference on Robotics
    and Automation. ICRA: International Conference on Robotics and AutomationICRA,
    4140–4147.'
  mla: Lechner, Mathias, et al. “Adversarial Training Is Not Ready for Robot Learning.”
    <i>2021 IEEE International Conference on Robotics and Automation</i>, 2021, pp.
    4140–47, doi:<a href="https://doi.org/10.1109/ICRA48506.2021.9561036">10.1109/ICRA48506.2021.9561036</a>.
  short: M. Lechner, R. Hasani, R. Grosu, D. Rus, T.A. Henzinger, in:, 2021 IEEE International
    Conference on Robotics and Automation, 2021, pp. 4140–4147.
conference:
  end_date: 2021-06-05
  location: Xi'an, China
  name: 'ICRA: International Conference on Robotics and Automation'
  start_date: 2021-05-30
date_created: 2022-01-25T15:44:54Z
date_published: 2021-01-01T00:00:00Z
date_updated: 2023-08-17T06:58:38Z
ddc:
- '000'
department:
- _id: GradSch
- _id: ToHe
doi: 10.1109/ICRA48506.2021.9561036
external_id:
  arxiv:
  - '2103.08187'
  isi:
  - '000765738803040'
has_accepted_license: '1'
isi: 1
language:
- iso: eng
license: https://creativecommons.org/licenses/by-nc-nd/3.0/
main_file_link:
- open_access: '1'
  url: https://arxiv.org/abs/2103.08187
oa: 1
oa_version: None
page: 4140-4147
project:
- _id: 25F42A32-B435-11E9-9278-68D0E5697425
  call_identifier: FWF
  grant_number: Z211
  name: The Wittgenstein Prize
publication: 2021 IEEE International Conference on Robotics and Automation
publication_identifier:
  eisbn:
  - 978-1-7281-9077-8
  eissn:
  - 2577-087X
  isbn:
  - 978-1-7281-9078-5
  issn:
  - 1050-4729
publication_status: published
quality_controlled: '1'
related_material:
  record:
  - id: '11362'
    relation: dissertation_contains
    status: public
series_title: ICRA
status: public
title: Adversarial training is not ready for robot learning
tmp:
  image: /images/cc_by_nc_nd.png
  legal_code_url: https://creativecommons.org/licenses/by-nc-nd/3.0/legalcode
  name: Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported (CC BY-NC-ND
    3.0)
  short: CC BY-NC-ND (3.0)
type: conference
user_id: 4359f0d1-fa6c-11eb-b949-802e58b17ae8
year: '2021'
...