Reinforcement learning (RL) controllers have been recently adopted for Unmanned Aerial Vehicles (UAV) navigation and control. However, they are susceptible to action-space attacks that overwrite the action commands after the policy generates them and before the actuators execute them. While most existing defenses target attacks on the policy's inputs, those addressing action-space attacks retrain the policy at training time and are not resilient to corrupted actions at runtime. We propose ASGARD, a two-phase teacher-student pipeline for making RL-based UAV control resilient to action-space attacks. In the teacher phase, an encoder combines the UAV's physical state with action-attack-related privileged information to produce an action-attack-aware latent that trains the RL control policy and a monitor that outputs corrected action commands to the actuators. In the student phase, both the encoder and the monitor are trained via supervised learning from their teacher counterparts to run on-board using only the UAV's physical state history. We evaluate ASGARD across attack scenarios targeting different action commands on UAV. We find that ASGARD is resilient to action-space attacks and completes the missions despite the attack. We further find that ASGARD generalizes to unseen attacks and remains resilient against stealthy attacks.
Figures & tables
Fig. 1 : Overview of ASGARD ’s operation. (1) Teacher Phase: the Teacher encoder combines privileged information with the UAV’s physical state to produce an action-attack-aware latent that trains the RL control policy and the Teacher monitor, which outputs corrected action commands to the actuators. (2) Student Phase: the Student encoder and Student monitor are trained via supervised learning from their Teacher counterparts, using only the UAV’s physical state history as input; these three components (Student Encoder, Control Policy, Student monitor) run together on-board at deployment.
Target Action
Bias Range
Attack Duration
Explain
Pitch
(-4)-(4)
max 90s
Disrupts or reverses forward progress
Roll
(-1)-(1)
max 90s
Turns a small adjustment into a hard, unintended lean
Thrust
(-5)-(5)
max 120s
Disrupts climb/descent rate
Gain
(-15)-(15)
max 150s
Distorts movement strength
All
(-1)-(1)
max 60s
All four simultaneously, worst-case scenario
TABLE I : Different types of attacks on each action command for evaluating ASGARD .
Fig. 2 : Training performance comparison. Left (a): Nominal conditions, all methods achieve similar final performance. Right (b): Adversarial conditions with action-space attacks , both ASGARD Teacher and Student converge faster than ARMOR while ARMOR has many fluctuations.
Fig. 3 : Flight trajectories under all action attack. Top: Baseline-RL, Middle: ARMOR, and Bottom: ASGARD , which keeps its intended trajectory despite the attack.
Target action
Baseline-RL
ARMOR
ASGARD
Success
Crash
State Drift (m)
Success
Crash
State Drift (m)
Success
Crash
State Drift (m)
Pitch
18%
69%
0.307 ± 0.012
25%
57%
0.287 ± 0.008
95%
0%
0.159 ± 0.004
Roll
19%
80%
0.418 ± 0.003
23%
75%
0.428 ± 0.010
94%
0%
0.393 ± 0.003
Thrust
61%
3%
0.608 ± 0.010
68%
0%
0.567 ± 0.034
97%
0%
0.394 ± 0.001
Gain
64%
35%
0.304 ± 0.001
85%
14%
0.295 ± 0.001
94%
0%
0.267 ± 0.001
All
0%
100%
0.359 ± 0.001
0%
100%
0.368 ± 0.001
67%
10%
0.259 ± 0.001
TABLE II : Performance comparison of Baseline-RL, ARMOR, and ASGARD under action attacks against five UAV action targets.
Fig. 4 : Attitude errors (degree) under Thrust action attack for Baseline-RL (left), ARMOR (middle), and ASGARD (right).
Techniques
Metrics
Roll
Thrust
Gain
ARMOR
Success
18%
50%
80%
Crash
81%
10%
15%
State Drift (m)
0.430 ± 0.014
0.597 ± 0.036
0.295 ± 0.001
ASGARD
Success
80%
60%
91%
Crash
12%
6%
5%
State Drift (m)
0.375 ± 0.063
0.356 ± 0.072
0.270 ± 0.016
TABLE III : ASGARD and ARMOR effectiveness when trained on Pitch action attacks only and tested on unseen attacks ( Zero-shot ).
Techniques
Metrics
Pitch
Roll
Thrust
ARMOR
Success
16%
14%
64%
Crash
82%
86%
4%
State Drift (m)
0.315 ± 0.009
0.436 ± 0.008
0.579 ± 0.050
ASGARD
Success
44%
81%
96%
Crash
10%
18%
0%
State Drift (m)
0.231 ± 0.006
0.385 ± 0.002
0.395 ± 0.000
TABLE IV : ASGARD and ARMOR effectiveness when trained on Gain action attacks only and tested on unseen attacks ( Zero-shot ).
Techniques
Success
Crash
State Drift (m)
ARMOR
0%
100%
0.419 ± 0.002
ASGARD
100%
0%
0.392 ± 0.002
TABLE V : ASGARD and ARMOR performance under stealthy action-space attacks .
Autonomous unmanned aerial vehicles (UAVs) increasingly rely on reinforcement learning (RL) for navigation, yet global navigation satellite system (GNSS) spoofing attacks can induce out-of-distribution observation shifts that corrupt value estimation and degrade mission performance. Existing robust RL methods often lack generalization to unseen attacks. To address this, we propose a curriculum-guided adaptation framework that progressively exposes a robust policy to gradient-based adversarial observation perturbations of increasing intensity while aligning temporal-difference (TD) error distributions across curriculum stages. By preserving TD-error consistency rather than targeting specific attack models, the framework promotes resilience across attack conditions. We further derive a TD-space generalization certificate that bounds performance degradation when the TD-error distribution under a test-time attack remains sufficiently close to that of the final curriculum stage. We evaluate the framework in a UAV deconfliction environment with dynamic 3D obstacles under unseen fixed and dynamic GNSS spoofing attacks. Under fixed spoofing, the curriculum-adapted (CurAd) policy achieves approximately 99-100% mission success across evaluated traffic densities, compared with 20-24% for the best-performing robust baseline, while also outperforming the non-robust vanilla baseline. Under dynamic obstacle-luring spoofing, CurAd achieves the highest episodic rewards and reduces median mission completion steps by up to 22% relative to the best-performing robust RL baseline. These findings demonstrate that adversarial curriculum adaptation transfers resilience from synthetic perturbations to unseen GNSS spoofing attacks without attack-specific retraining, enhancing robust autonomous UAV navigation.
Deepak Kumar Panda, Adolfo Perrusquia, Weisi Guo
the Faculty of Engineering and Applied Sciences, Cranfield University, MK43 0AL Cranfield, U.K
Deep reinforcement learning has shown strong potential for enabling autonomous robots to learn complex navigational tasks. However, its practical use still depends heavily on human designed reward functions and repeated manual fine tuning, which is time consuming and does not guarantee high success in the desired task. This paper presents AgenticRL, agent guided reinforcement learning framework that increases autonomy in reward design, policy refinement, and real world deployment for unmanned aerial vehicles (UAV) navigation tasks. AgenticRL uses a multimodal generative pre-trained transformer (GPT) agent to interpret task information and visual scene observations, generate task specific reward functions, train policies using Proximal Policy Optimization (PPO) algorithm, and then act as a critic by evaluating the trained policy through diagnosis packets to generate feedback. Based on this feedback, the agent identifies failure modes and refines the reward function in a closed loop self improvement process. To further leverage the multimodal GPT agent during inference, AgenticRL uses real world images and natural language task information to automatically identify the active scenario and select the appropriate trained policy for execution. The framework is evaluated on multiple navigational tasks, including gate traversal, obstacle avoidance, wall barrier crossing with landing, trajectory following, and motion behavior learning. Experimental results show that the closed loop refinement process improves policy behavior compared with initial rewards by 71%. We also demonstrate sim-to-real transfer of the proposed framework, achieving a real world success rate of 91% and a sim-to-real accuracy of 94%.
Roohan Ahmed Khan, Yasheerah Yaqoot, Amir Atef Habel +2
With the rapid development of autonomous aerial systems, Unmanned Aerial Vehicles (UAVs) are increasingly deployed in applications such as inspection, environmental monitoring, and rescue, creating growing demand for reliable autonomous navigation. However, autonomous UAV navigation in dense environments remains challenging under sparse perception and dynamic constraints. Most reinforcement learning (RL) methods lack explicit safety mechanisms, leading to unsafe exploration, unstable training, and risky behaviors, especially during high-speed flight. Even in safe RL approaches, safety is often enforced by projecting policy outputs onto a safe action set, which may introduce instability. Meanwhile, many learning-based methods rely on dense inputs or large networks, increasing computational burden and limiting lightweight onboard deployment. Facing the above challenges, we propose a safety-constrained perception-control integrated framework for UAV navigation. A lightweight network encodes sparse observations into collision-risk-aware features using asymmetric and depthwise separable convolutions. We formulate the task as a constrained Markov decision process within a hierarchical control architecture and solve it using a Lagrangian-based safe PPO algorithm. Curriculum learning further improves training stability. Experiments with varying obstacle densities and flight speeds demonstrate higher success rates, improved safety, and better efficiency than existing reinforcement learning baselines.