Researchers Develop Efficient Method to Attack Visual AI Agents Without Model Access

Adversarial attacks on AI systems that learn from visual inputs pose a growing security concern, yet researchers have struggled to develop practical attack strategies that work without internal model access. A team of computer scientists has introduced SEBA, a framework designed to efficiently compromise visual reinforcement learning agents through black-box attacks—meaning the attacker cannot inspect the model's internal workings.

The Challenge#

Most prior adversarial attack methods have focused on simpler RL systems that handle discrete actions or vector-based inputs rather than the complex visual control tasks now widely used in robotics and autonomous systems. Visual RL operates in a particularly difficult attack scenario: the action space is enormous (continuous rather than discrete), and traditional attack strategies require thousands of queries to the target system, making them impractical in real-world deployments where query budgets are limited.

How SEBA Works#

SEBA combines three key technical components to achieve efficiency:

• Shadow model: An auxiliary Q-learning module that predicts cumulative rewards the agent would receive under adversarial conditions, allowing the attacker to reason about attack success without constant feedback from the target
• Generative adversarial network: Creates nearly invisible perturbations—tiny alterations to images that fool the agent while appearing unchanged to human observers
• World model: Simulates environment dynamics to reduce the number of actual interactions needed with the target system

The framework uses a two-stage iterative training cycle that alternates between refining the shadow model's predictions and improving the perturbation generator. This approach dramatically cuts down the total number of queries required compared to methods that probe the target system directly.

Performance Gains#

Testing on standard benchmarks including MuJoCo physics simulations and Atari games, SEBA significantly degraded agent performance while maintaining visual quality and requiring substantially fewer environment interactions than competing approaches—both those with and without model access. The researchers have made their code publicly available to support reproducibility and further research.