Reinforcement Learning for Linear Quadratic Control is Vulnerable Under
  Cost Manipulation
  In this work, we study the deception of a Linear-Quadratic-Gaussian (LQG)
agent by manipulating the cost signals. We show that a small falsification of
the cost parameters will only lead to a bounded change in the optimal policy.
The bound is linear on the amount of falsification the attacker can apply to
the cost parameters. We propose an attack model where the attacker aims to
mislead the agent into learning a `nefarious' policy by intentionally
falsifying the cost parameters. We formulate the attack's problem as a convex
optimization problem and develop necessary and sufficient conditions to check
the achievability of the attacker's goal.
  We showcase the adversarial manipulation on two types of LQG learners: the
batch RL learner and the other is the adaptive dynamic programming (ADP)
learner. Our results demonstrate that with only 2.296% of falsification on the
cost data, the attacker misleads the batch RL into learning the 'nefarious'
policy that leads the vehicle to a dangerous position. The attacker can also
gradually trick the ADP learner into learning the same `nefarious' policy by
consistently feeding the learner a falsified cost signal that stays close to
the actual cost signal. The paper aims to raise people's awareness of the
security threats faced by RL-enabled control systems.
