A Minimally Informed Black-Box Fake-Report Attack on DRL Traffic-Signal Control

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Deep reinforcement learning (DRL) traffic-signal controllers may use vehicle-to-infrastructure (V2I) reports, exposing their perception layer to false-data injection. Existing demonstrations typically assume either white-box access to the controller's weights or full observability of the traffic state. We study the impact of a weaker and more realistic adversary who has no access to the RL model and whose traffic observations are limited to her own approach. This black-box, minimally informed attacker trains an imitation surrogate of the controller. She then crafts bounded fake reports, restricted to inflating vehicle counts on her own approach, that transfer to the real controller. We demonstrate that despite the loss of accuracy relative to an attacker who can observe the entire state and action space, this limited attacker can significantly increase the average waiting time for other approaches while barely changing the waiting time on her own approach, i.e. externalizing the added delay onto the other approaches. Because the only realizable move is to inflate one's own reported queue, we find that a zero-knowledge attacker that simply reports the maximum feasible queue is as damaging as the surrogate-based one, while an unstructured random inflation is not: the surrogate is not required to reproduce the degradation, and the exposed vulnerability is the V2I sensing channel itself. The surrogate's role is directional control, selecting a disruptive or a selfish objective at the same budget. The attack persists under +/-20% uniform demand variation. Finally, on a common per-lane budget we place the attacker on a knowledge ladder against white-box adversaries, and find the black-box surrogate matches a realizable white-box attacker that uses the victim's own gradients; only abandoning realizability raises the damage further.