CAAP: Context-Adaptive Adversarial Policy Learning Under Partial Observability

Abstract

Adversarial policies provide a practical means of stress-testing reinforcement-learning agents by inducing failure through environment interactions without modifying the deployed victim policy. Learning effective adversarial policies under partial observability is challenging because the attacker must act from incomplete observations without access to victim-side parameters, gradients, or internal states. Existing approaches often rely on instantaneous observability patterns or predefined partitions, which can discard temporal interaction information and provide limited guidance for exploring rarely encountered but potentially vulnerable contexts. We propose CAAP (Context-Adaptive Adversarial Policy), which is a black-box adversarial policy framework that represents recent interaction history with a recurrent Context Encoder, combines multiple action-value experts through a differentiable Soft Policy Router, and encourages early exploration through Context Coverage Exploration using an annealed KNN-based coverage bonus in the learned context space. Context Coverage Exploration is used only during training, leaving the Context Encoder, Soft Policy Router, and action-value experts as the deployed policy. In the primary particle-pursuit benchmark, CAAP achieves the lowest in-domain catch rate among the five internal methods and the lowest macro-average catch rate across eight zero-update transfer conditions. These results support the use of history-dependent Soft Policy Routing with training-only Context Coverage Exploration for black-box adversarial policy learning under partial observability.