对抗性计划
Adversarial Plannning
摘要：
规划算法在计算系统中用于指导自主行为。例如，在规范应用中，自动驾驶车辆的规划用于自动化针对性能、资源管理或功能目标（例如，到达目的地、管理燃料消耗）。现有的规划算法假设非对抗性设置;基于可用的环境信息（即，输入实例）。然而，目前还不清楚这些算法在面对试图阻挠计划者的对手时将如何表现。在本文中，我们探讨了网络和网络物理系统中使用的规划算法的安全性。我们提出了两种$\textit{adversarial planning}$算法--一种是静态的，一种是自适应的--它们会扰动输入规划实例以最大化成本（通常是实质上的）。我们评估了算法对商业应用中使用的两种主要规划算法（D * Lite和Fast Downward）的性能，并表明两者都容易受到极其有限的对抗行为的影响。在这里，实验表明，对手能够通过仅从动作空间（D * Lite）中删除单个动作来增加66.9%的实例的计划成本，并且通过仅删除三个动作（快进）来使国际规划竞赛中70%的实例无法解决。最后，我们发现，在任何搜索为基础的规划系统中找到一个最佳的扰动是NP难的。
英文摘要：
Planning algorithms are used in computational systems to direct autonomous behavior. In a canonical application, for example, planning for autonomous vehicles is used to automate the static or continuous planning towards performance, resource management, or functional goals (e.g., arriving at the destination, managing fuel fuel consumption). Existing planning algorithms assume non-adversarial settings; a least-cost plan is developed based on available environmental information (i.e., the input instance). Yet, it is unclear how such algorithms will perform in the face of adversaries attempting to thwart the planner. In this paper, we explore the security of planning algorithms used in cyber- and cyber-physical systems. We present two $\textit{adversarial planning}$ algorithms-one static and one adaptive-that perturb input planning instances to maximize cost (often substantially so). We evaluate the performance of the algorithms against two dominant planning algorithms used in commercial applications (D* Lite and Fast Downward) and show both are vulnerable to extremely limited adversarial action. Here, experiments show that an adversary is able to increase plan costs in 66.9% of instances by only removing a single action from the actions space (D* Lite) and render 70% of instances from an international planning competition unsolvable by removing only three actions (Fast Forward). Finally, we show that finding an optimal perturbation in any search-based planning system is NP-hard.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
