cs.LGSep 17, 2026

ASGARD: Action-Space Guard for UAV Resilience via Reinforcement Learning

Authors: Mohsen Salehi, Karthik Pattabiraman

Organizations: The University of British Columbia Vancouver, Canada

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Reinforcement learning (RL) controllers have been recently adopted for Unmanned Aerial Vehicles (UAV) navigation and control. However, they are susceptible to action-space attacks that overwrite the action commands after the policy generates them and before the actuators execute them. While most existing defenses target attacks on the policy's inputs, those addressing action-space attacks retrain the policy at training time and are not resilient to corrupted actions at runtime. We propose ASGARD, a two-phase teacher-student pipeline for making RL-based UAV control resilient to action-space attacks. In the teacher phase, an encoder combines the UAV's physical state with action-attack-related privileged information to produce an action-attack-aware latent that trains the RL control policy and a monitor that outputs corrected action commands to the actuators. In the student phase, both the encoder and the monitor are trained via supervised learning from their teacher counterparts to run on-board using only the UAV's physical state history. We evaluate ASGARD across attack scenarios targeting different action commands on UAV. We find that ASGARD is resilient to action-space attacks and completes the missions despite the attack. We further find that ASGARD generalizes to unseen attacks and remains resilient against stealthy attacks.

Figures & tables

Fig. 1 : Overview of ASGARD ’s operation. (1) Teacher Phase: the Teacher encoder combines privileged information with the UAV’s physical state to produce an action-attack-aware latent that trains the RL control policy and the Teacher monitor, which outputs corrected action commands to the actuators. (2) Student Phase: the Student encoder and Student monitor are trained via supervised learning from their Teacher counterparts, using only the UAV’s physical state history as input; these three components (Student Encoder, Control Policy, Student monitor) run together on-board at deployment.
Target ActionBias RangeAttack DurationExplain
Pitch(-4)-(4)max 90sDisrupts or reverses forward progress
Roll(-1)-(1)max 90sTurns a small adjustment into a hard, unintended lean
Thrust(-5)-(5)max 120sDisrupts climb/descent rate
Gain(-15)-(15)max 150sDistorts movement strength
All(-1)-(1)max 60sAll four simultaneously, worst-case scenario
TABLE I : Different types of attacks on each action command for evaluating ASGARD .
Fig. 2 : Training performance comparison. Left (a): Nominal conditions, all methods achieve similar final performance. Right (b): Adversarial conditions with action-space attacks , both ASGARD Teacher and Student converge faster than ARMOR while ARMOR has many fluctuations.
Fig. 3 : Flight trajectories under all action attack. Top: Baseline-RL, Middle: ARMOR, and Bottom: ASGARD , which keeps its intended trajectory despite the attack.
Target actionBaseline-RLARMORASGARD
SuccessCrashState Drift (m)SuccessCrashState Drift (m)SuccessCrashState Drift (m)
Pitch18%69%0.307 ±\pm 0.01225%57%0.287 ±\pm 0.00895%0%0.159 ±\pm 0.004
Roll19%80%0.418 ±\pm 0.00323%75%0.428 ±\pm 0.01094%0%0.393 ±\pm 0.003
Thrust61%3%0.608 ±\pm 0.01068%0%0.567 ±\pm 0.03497%0%0.394 ±\pm 0.001
Gain64%35%0.304 ±\pm 0.00185%14%0.295 ±\pm 0.00194%0%0.267 ±\pm 0.001
All0%100%0.359 ±\pm 0.0010%100%0.368 ±\pm 0.00167%10%0.259 ±\pm 0.001
TABLE II : Performance comparison of Baseline-RL, ARMOR, and ASGARD under action attacks against five UAV action targets.
Fig. 4 : Attitude errors (degree) under Thrust action attack for Baseline-RL (left), ARMOR (middle), and ASGARD (right).
TechniquesMetricsRollThrustGain
ARMORSuccess18%50%80%
Crash81%10%15%
State Drift (m)0.430 ±\pm 0.0140.597 ±\pm 0.0360.295 ±\pm 0.001
ASGARDSuccess80%60%91%
Crash12%6%5%
State Drift (m)0.375 ±\pm 0.0630.356 ±\pm 0.0720.270 ±\pm 0.016
TABLE III : ASGARD and ARMOR effectiveness when trained on Pitch action attacks only and tested on unseen attacks ( Zero-shot ).
TechniquesMetricsPitchRollThrust
ARMORSuccess16%14%64%
Crash82%86%4%
State Drift (m)0.315 ±\pm 0.0090.436 ±\pm 0.0080.579 ±\pm 0.050
ASGARDSuccess44%81%96%
Crash10%18%0%
State Drift (m)0.231 ±\pm 0.0060.385 ±\pm 0.0020.395 ±\pm 0.000
TABLE IV : ASGARD and ARMOR effectiveness when trained on Gain action attacks only and tested on unseen attacks ( Zero-shot ).
TechniquesSuccessCrashState Drift (m)
ARMOR0%100%0.419 ±\pm 0.002
ASGARD100%0%0.392 ±\pm 0.002
TABLE V : ASGARD and ARMOR performance under stealthy action-space attacks .
More in this topic

Robust RL

Robust reinforcement learning develops agents that maintain performance and safety under uncertainty, disturbances, attacks, and distribution shifts.

See all 221 papers

Explore similar work

CardsList

  1. Curriculum-Adapted Robust Reinforcement Learning for UAV Deconfliction in Adversarial Environments

    Jun 26, 2025Deepak Kumar Panda, Adolfo Perrusquia, Weisi GuoRobust RLUAV Navigation

    the Faculty of Engineering and Applied Sciences, Cranfield University, MK43 0AL Cranfield, U.K

  2. AgenticRL: Self-Refining Agentic Reinforcement Learning for Vision-Conditioned UAV Navigation

    Jun 2, 2026Roohan Ahmed Khan, Yasheerah Yaqoot, Amir Atef Habel +2RL for RoboticsAgentic RL

  3. Lightweight Safe Reinforcement Learning for End-to-End UAV Navigation

    Jul 2, 2026Shenghui Zhang, YuXuan Gao, Songwei Zhao +3Robot Policy LearningUAV Navigation