  This study considers the attack on reinforcement learning agents where the
adversary aims to control the victim's behavior as specified by the adversary
by adding adversarial modifications to the victim's state observation. While
some attack methods reported success in manipulating the victim agent's
behavior, these methods often rely on environment-specific heuristics. In
addition, all existing attack methods require white-box access to the victim's
policy. In this study, we propose a novel method for manipulating the victim
agent in the black-box (i.e., the adversary is allowed to observe the victim's
state and action only) and no-box (i.e., the adversary is allowed to observe
the victim's state only) setting without requiring environment-specific
heuristics. Our attack method is formulated as a bi-level optimization problem
that is reduced to a distribution matching problem and can be solved by an
existing imitation learning algorithm in the black-box and no-box settings.
Empirical evaluations on several reinforcement learning benchmarks show that
our proposed method has superior attack performance to baselines.
