Supervision via Competition: Robot Adversaries for Learning Tasks

by   Lerrel Pinto, et al.

There has been a recent paradigm shift in robotics to data-driven learning for planning and control. Due to large number of experiences required for training, most of these approaches use a self-supervised paradigm: using sensors to measure success/failure. However, in most cases, these sensors provide weak supervision at best. In this work, we propose an adversarial learning framework that pits an adversary against the robot learning the task. In an effort to defeat the adversary, the original robot learns to perform the task with more robustness leading to overall improved performance. We show that this adversarial framework forces the the robot to learn a better grasping model in order to overcome the adversary. By grasping 82 objects compared to 68 creating adversaries. We also demonstrate via experiments that having robots in adversarial setting might be a better learning strategy as compared to having collaborative multiple robots.


page 1

page 3

page 4

page 5

page 6

page 7


Robot Learning via Human Adversarial Games

Much work in robotics has focused on "human-in-the-loop" learning techni...

Learning Task-Oriented Grasping for Tool Manipulation from Simulated Self-Supervision

Tool manipulation is vital for facilitating robots to complete challengi...

Learning Agile Locomotion via Adversarial Training

Developing controllers for agile locomotion is a long-standing challenge...

Learning Task-Oriented Grasping from Human Activity Datasets

We propose to leverage a real-world, human activity RGB datasets to teac...

GraspARL: Dynamic Grasping via Adversarial Reinforcement Learning

Grasping moving objects, such as goods on a belt or living animals, is a...

Learning Generative Adversarial RePresentations (GAP) under Fairness and Censoring Constraints

We present Generative Adversarial rePresentations (GAP) as a data-driven...

Tracking Cyber Adversaries with Adaptive Indicators of Compromise

A forensics investigation after a breach often uncovers network and host...

I Introduction

There has been a recent push in robotics to move from analytical reasoning to more data-driven and self-supervised learning of planning and control. Specifically, the paradigm of end-to-end learning has gained a lot of prominence. In an end-to-end learning framework, the input is the perceived image and the output is the action primitives or torques themselves. Amazingly, it has been shown that given a specific task, if enough amount of data is collected, these frameworks can outperform manually designed mathematical models 

[1, 2, 3, 4].

However, the critics of self-supervised learning often argue that the amount of data required to learn these models effectively is huge and presents a big bottleneck. For example, in our recent paper [2], we collect more than 50K examples to learn a grasping model. Furthermore, since most end-to-end learning approaches deal with large amounts of data, they use self-supervision from other sensors. This more often leads to weaker notion of success. For example, [2] uses a force sensor in the gripper to see if the robot was successful in grasping the object. This often leads to an unstable grasp (see figure 2

for examples) being classified as a good grasp in the self-supervised framework.

To address the data scalability concerns, researchers at Google developed an arm farm with between 6-14 robots to collect 800K examples for grasping in parallel [4]. This effort demonstrated how exploration can be parallelized and used to collect data at scales like never before. However, apart from scaling up data collection, is there another way to improve performance? In fact, it is known from the rich history of ML that “all data is not equal” [5, 6]. It has been often shown that mining hard examples leads to faster convergence and better performance. Similarly, obtaining better labels for training tends to make learning more efficient and robust. So, when using multiple robots, is there a better way to use multiple robots for exploration leading to faster learning and robust task performance?

Fig. 1: We propose an adversarial framework for effective self-supervised learning. In our framework, the protagonist attempts to learn policy for a task such as grasping. While an adversary learns the task to make the protagonist fail at its task. For example, in the figure above, adversary tries to snatch the object from protagonist. Both the policies are learned simultaneously leading to robust learning of protagonist.
Fig. 2: (first row) Examples of successful yet unstable grasps. (second row) Examples of stable and successful grasps.

Inspired by the recent work in adversarial learning [7, 8], we propose a novel physical “adversarial” framework to collect data for manipulation tasks such as grasping. Instead of using robots in a collaborative fashion, we propose to create robot adversaries for self-supervised learning. Specifically, we have an original learner that learns how to perform the task such as grasping; and the adversarial learner tries to learn a task/policy which makes the original learner fail on its task. For example, if the first learner is trying to learn how to grasp the object; the adversarial learner attempts to learn how to steal the object via snatching. This in turn forces the original learner to learn to grasp in a robust manner such that it cannot be snatched by the adversary. In this paper, we create two such adversarial frameworks for grasping. We show how adversarial tasks can help us provide supervision/labeling which rejects weak notions of success leading to faster and better learning.

More importantly, we demonstrate quantitatively that using an adversarial framework leads to a significantly better grasping policy as compared to having two robots collect data in parallel for the same task.

Fig. 3: Given a weak grasp, an adversary can destabilize in multiple ways. Left shows the motion of a linear shake on the same arm that could destabilize this grasp. Another way to destabilize this is a push grasp on this object by a different arm and then pull. Center shows hows how snatching/pulling can destabilize the grasp, while right shows how the pushing motion can destabilize the grasp.

Ii Related Work

The learning framework we propose intersects with numerous areas of research. In particular, our method employs adversarial learning in physical robots. We then demonstrate the significant improvements this brings to training a robot to grasp.

Self-supervised deep learning

. Data-driven approaches in robotics have gained popularity based on the success of deep neural network methods in other domains including computer vision


and reinforcement learning


. In robotics, to solve data requirements, deep learning methods have been coupled with self-supervision to generate end-to-end learning solutions

[1, 2, 11, 3, 4].

Active Learning

. Active learning is often employed in domains where data is cheap but labeling is expensive. This is the case in self-supervised paradigms, where the cost of labeling corresponds in part to the time it takes to run the experiment, so there is often a severe limit on the practical amount of data that can be generated. Active learning is motivated by the idea that fewer examples can result in better accuracy if the right data is chosen (refer to

[12]). In simplified, linear classification problems, it has been shown that exponential decrease is achievable in expectation with no efficiency gains in the worst case [13]. We will show that our technique, which operates over much more complex decision surfaces still achieves significant performance boost over naive sampling.

Our work is also related to Hard-negative/example mining [5, 6], formerly referred to as bootstrap learning. Recent methods in computer vision [14, 15, 16, 17] and sample efficiency in reinforcement learning [18] apply hard example mining to train deep neural networks. These methods, however, base their filter of examples by the loss of each sample. In our case, adversarial/antagonist network guides the training of the original network to select harder training set.

The value of more efficient training in robotics has long been investigated due to the high cost of data. Use of active learning has ranged from curriculum learning [19], selectively filtered uncommon or interesting data [20], to directed exploration in reinforcement learning (see [21]). Much of the recent work in improving exploration for deep learned models has focused reducing uncertainty [22, 23] or is novelty seeking [24, 25]. Unlike reinforcement learning, our approach is a repeated game of a single time-step. Moreover, to our knowledge, no previous work in robotics or reinforcement learning has trained an adversary to guide exploration or for sample efficiency.

Game Theory. We formulate our adversarial training as a two player zero sum repeated game (refer to [26]

for an overview of game theory). Game theory has been explored in many robotics applications. Multi-agent systems

[27, 28] are often formulated as a cooperative game. In pursuit evasion [29] and robust control methods [30], nature acts as the opponent against the system forcing the system to chose safe actions. Our approach is analogous, as the adversary forces the system to choose more stable actions. Unlike existing robotic game theoretic approaches, our technique trains two differing neural networks to act as both players.

Adversarial methods. Generative adversarial methods [7, 8] are similar in that they train two neural network agents in a game theoretic settings. However, the objective is to train a model capable of generating examples indistinguishable from training examples. More recent work leverages adversarial examples, similar to hard-negative mining approaches discussed above, to train a more robust classifiers [31]. This method generates new samples based on analysis of a single trained network. Our formulation relies on two discriminative models that adapts to the current behavior of the opposing player.

Grasping. We test out our technique on the grasping problem, an intensely researched problem which is a complex task requiring a robust solution. Refer to [32, 33] for surveys of prior work. Significant progress has been made recently using data-driven solutions for training deep learned models on both corporeal robots [1, 2, 3, 4] and in simulation [34, 35].

Early work sought to define stable grasp metrics using analytic methods [36]. However, later work found such metrics unstable under shaking [37] and pose uncertainty [38, 39]. Our approach demonstrates that adversarial agent in a data-driven context leverage these destabilizing factors to train a more effective solution. While we demonstrate the core algorithm on stable grasping, we believe the approach is applicable to other domains.

Iii Overview

The goal of this paper is to explore how we can improve self-supervised systems with respect to (a) the quality of supervision and (b) robustness of the trained models. Current self-supervised systems use combinations of sensors to define success/failure on tasks [1, 2, 3, 4]. For example, in grasping, a force sensor in the gripper can be used to see if the robot was successful in grasping. However, such supervision is weak and noisy at best.

In this paper, we argue that learning to defeat an adversarial robot might provide significantly better supervision. Specifically, we learn models for two tasks simultaneously: one model is learned for the original-task such as grasping; the other model learns an adversarial task to defeat the original-task model. As an example, for grasping one adversarial task is to snatch the grasped object from the original model. An important feature of this joint learning is that while the adversarial is learning how to defeat original model; the original model adapts itself to defeat the adversarial model. This leads to greater robustness in the task performance compared to the original model itself.

Specifically, in this paper, we explore the use of adversarial robots for the task of grasping through two adversarial mechanisms. The first shakes the object in the gripper to break the grasp. The second adversarial mechanism is snatching. Given an object grasped by one arm of a robot, the adversary attempts to snatch the object using a second arm (in our experiment we use Baxter robot, which has two arms). Therefore, the original GraspNet tries to learn the grasping task such that it is robust to either a shaking or snatching adversary, respectively. Experimentally, we demonstrate that learning via competition from an adversarial model helps improve the performance on the test data.

Iv Adversarial Learning Framework

Iv-a Formulation

For purposes of explanation, the agent is the protagonist being trained to perform the task and the adversary is the antagonist attempting to defeat the agent. Our goal is to learn a non-linear function (we use ConvNets and represent the parameters) which given the current state of the environment (represented as ) predicts the action parameters . Therefore, . At the same time, we also try to learn an adversarial task , which given some state representation() after the action , predicts the adversarial action parameters . Therefore, . Note that the state of the world after protagonist action, , depends on the action and the world.

Fig. 4: The shake space contains 15 discrete actions, with 3 directions of linear shake for 5 different configurations. These 5 configurations are seen as individual images with the 3 directions of shake shown by white arrows.

The optimization goal is to learn according to the following criteria:


where is the original task loss and is the adversary loss. Therefore, if the protagonist was successful on the original task and otherwise. Similarly, if the adversary was successful in defeating the protagonist. Note that is the weighting factor for learning of the protagonist.

The second term in the objective function pushes the adversary to learn parameters such that adversary’s action leads to agent’s failure (minimizing adversary’s loss). However, the original protagonist is trying to learn the parameters such: (a) the agent is able to minimize its own loss (the first term) and (b) maximize adversary loss, which implies the original task is performed so robustly that the adversary cannot defeat it.

Iv-B Optimization

Initializing : We first learn original task, without any adversary in play, only using the weak notion of success. Therefore, we collect the data with random actions and see which actions lead to success in the task using the sensors. This data is used to learn an original ConvNet. Note that the ConvNet

gives probability of success for all possible actions and therefore the policy is to select the action in greedy manner.


Initializing : Given the initial learned ConvNet for the original task, we use it to perform the task followed by an adversary action . Initially, we use a random adversary policy and collect data to observe effect of random adversary actions on the original task. We use the collected data to learn ConvNet for initial adversary task. Again, the ConvNet gives probability of success for all possible adversary actions.

Joint Training: Once we have initialized both protagonist and adversary task networks, we use the ConvNets to collect joint data. The original task network () defines the probability of success for all actions, we select the action with the highest probability of success and perform the action . If the is unsuccessful, we update parameters of original task network . If the is successful, then the adversary network () is used to select an adversary action

. Based on the success or failure of adversary action, both the adversary and protagonist network parameters are updated. This procedure is repeated by generating a series of batch updates for each iteration. Training repeated multiple epochs until a minimum accuracy threshold on the train set was achieved.

Fig. 5: The network used by both the protagonist and the antagonist is modeled after AlexNet [9]

. The output of this network is scaled by using a sigmoidal function.

V Experimental Framework

We demonstrate the effectiveness of the proposed adversarial framework for the task of grasping using two different adversaries: shaking the hand holding the object; snatching the object using the other hand.

V-a Grasp prediction formulation

We formulate our problem to perform planar grasping [2], which defines action space/grasp configuration using three parameters: as position of grasp point on the surface of table and angle of grasp, respectively. This reduces the task of finding successful grasps to finding a successful configuration, in a given image . Examples of planar grasps are shown in Figure 6. However, as mentioned in [2]

, this formulation is problematic due to the presence of multiple grasp locations for each object. Therefore, we sample image patches from the input image and evaluate them by the ConvNet to give probability of success for all the grasp angles with grasp location being center of patch. Given an image patch, we output an 18-dimensional likelihood vector where each dimension represents the likelihood of whether the center of the patch is graspable at

, , …. Therefore, the grasping problem can be thought of as 18 binary classification problems.

V-B Grasping as the protagonist agent

Figure 5 with describes the network architecture for our protagonist agent policy. Given an input image , multiple () patches are sampled. For each of these patches the agent network predicts the probabilities of successful grasping in the 18 different grasp angles. This gives a grasp probability matrix. Depending on the exploration strategy, an element is chosen from this matrix which corresponds to the grasp configuration . This grasp is then executed. The agent policy hence uses the state representation as the input image, i.e. and outputs the grasp action .

Fig. 6: Examples of successful (top) and unsuccessful grasps (bottom). We use a patch based representation for grasping: given an input patch we predict 18-dim vector which represents whether the center location of the patch is graspable at , , ….

V-C Shake formulation

Shaking is used as one of the adversarial mechanisms (Figure  7). After the protagonist grasping agent grasps an object, the antagonist attempts to destabilize the grasp by vigorously shaking the end effector. The shake action space is discrete with 15 possible options. Each shake action corresponds to pair of end effector orientation and direction of linear shake. There are 5 end effector orientations used in this work as shown in Figure 4 and 3 possible directions of linear shake for each of these orientations. A sample end effector shake motion can be seen in Figure  7. Note that the frequency and amplitude of the shake is held constant for all the shake actions.

Fig. 7: Left shows an example of the shake motion. Right shows the end effector position trajectory that shakes the grasped object at 2Hz with an amplitude of 25mm

V-D Snatch formulation

The other adversarial mechanism we explore is snatching (Figure  8). After the protagonist grasping agent grasps an object, the antagonist attempts to destabilize the grasp by attempting first to push grasp  [40] followed by pulling the object. Note that here the antagonist does not have control over the protagonist’s arm but has control over a second arm that attempts this push grasp. The snatch action space is discrete with 36 possible options. Each snatch action corresponds to a grasp point in the plane of the object (see Figure  9). There are 9 translational configurations and 4 rotational configurations. A sample end effector pull motion can be seen in Figure  8.

Fig. 8: During a snatch action, the adversary (left) first performs a push grasp on the object held by the other arm (center) and then then pulls (right).
Fig. 9: The snatch space contains 36 discrete actions, with 9 grasp points and 4 angles of grasp on each of these grasp points. All of these 36 possible grasps are overlayed on an image of the grasped image in this figure

V-E Antagonist adversary

Given the original state and the executed action , we represent the current state as a function of and (say ). In this work is the image patch of centered at an rotated by . Hence, is the grasped patch of the object rotated by the angle of grasp so that it is visible in canonical viewpoint. This effectively encodes the image patch after the agent’s fingers grasp the object. This means that the adversary’s state representation is also the image .

The adversary policy now has to predict the adversarial action . For this we again use the deep network () architecture in Figure  5. For shaking, there are 15 actions, so and . Snatching has 36 actions, so and . Given the state , the network produces the probabilities of the adversary succeeding for the different actions. Based on the adversary’s exploration strategy, the action

is sampled from the probability distribution and executed. The adversary policy

hence uses the state representation as a rotated patch and outputs the adversarial action .

Fig. 10: The shaking adversarial framework’ pipeline is shown here. Given an image, the grasping agent inputs patch samples and outputs the best prediction for grasp. If it is successful in grasping the object, the shaking agent chooses its best prediction to destabilize the grasp and executes it. All of this data is aggregated for training the next iteration of the grasping and shaking agents.

V-F Network architecture

For all the networks, we used the same ConvNet architecture. Specifically, the architecture used in this work (Figure  5) is modeled on AlexNet  [9]

. The only difference being the fewer neurons in fc7 (1024 vs 4096). The output of the network is scaled to (0,1) using a sigmoidal response function. The convolutional weights are initialized from ImageNet pretrained weights, while the fully connected weights are initialized randomly.

V-G Learning to grasp with shake adversary

In our formulation to jointly train the grasping agent and the shaking adversary, we would first initialize the policy of the agent and the adversary. For the grasping task, we first collect random samples [2] and train an initial model on this. Let this dataset of random grasps be called . Each element of contains a patch grasped , the discrete angle at which it was grasped and if the grasp succeeded or failed. The training target is given by


Using this, the grasping network is trained using the sigmoidal outputs of the network in as predictions . The loss for this training is the binary cross entropy loss between and

. This network is trained using RMSProp 


Now given the initial grasping policy , we grasp objects by sampling from the probability distribution generated by the network in . Once this grasp is executed random shakes are applied on the grasped objects. We call this dataset , where is the shake data (success or failure of the shaking adversary).

Given a successful grasp in , first is rotated with the angle represented by to get . The target for the network in is now


Using this, the shaking network is trained using the sigmoidal outputs of the network in as predictions . The loss for this training is the binary cross entropy loss between and . This network is trained using RMSProp. Hence using these random shakes, the initial shaking policy is learnt.

To train , we again use the dataset . The training target for , is given by


Here, is the maximum probability the network in believes it can destabilize the grasping agent. is a factor that controls how strong the adversary controls the learning of the agent. Using these labels, network in is trained.

Once we have our initial models and , we now follow the iterative training process. For iteration , we grasp objects using with importance sampling on grasp probabilities. For successful grasps shakes are applied according to with greedy sampling on shake probabilities. The data collected is then used to train first followed by . The data collection procedure is described in Figure  10.

Vi Discussion

Vi-a Hardware Setup

All our experiments were run on a Baxter robot. The protagonist arm is employed with parallel jaw grippers which can apply up to 35N of gripping force with maximum payload of 2.2Kg. However, for the collection of adversarial data, the gripping force was reduced to 7N to bias the framework towards the adversary. However for final testing we report results with the maximum gripping force as well as with the train time gripping force. For experiments with the snatching adversary, the other arm of Baxter is used to snatch grasped objects from the protagonist arm.

Vi-B Data Collected

The grasping model was initialized using 40K grasping tries from  [2].

For the shaking task, a total of 9k grasps are attempted over 3 iterations of batch adversarial learning. Out of these, the protagonist successfully grasped 2.4k. This low grasping rate can be attributed to our exploration strategy where we use importance sampling to sample grasps. Out of these successful grasps 0.5k were dislodged by the adversary.

For the snatching task, a total of 2k grasps are attempted over 2 iterations of batch adversarial training. The grasp network in this case was initialized with the grasp network trained by the shake adversary. Out of the 2k grasps attempted, the protagonist successfully grasped 0.7k. Of these, 0.2k adversarial snatches were successful in dislodging the protagonist.

For the baseline, we trained a grasping model using 56K training examples. Note that the baseline is trained with more data points assuming two robots can collect data faster in parallel (collaborative setting rather than adversarial).

Vi-C Grasping Results

Fig. 11: We perform our grasping analysis on these 10 objects. Note that the objects present a mix of difficulty, with deformable objects, non convex objects and heavy objects.

For demonstrating the improvements of our adversarial framework, we use the objects shown in Figure  11. These objects are novel and have not been seen by the robot before. As a baseline we train a grasping model with the same amount of data as the adversarial model but without adversarial supervision. This is similar to  [2]. The results for grasping with low gripping force (20% of maximum gripping force), without additional grip and by sampling only 128 patches on the input image can be seen in Table  I. For a successful grasp to be reported, the object must be grasped and lifted 30cm from the table.

We can clearly see the improvement by the adversarial framework among these objects. After 3 iterations of training with shaking adversary, our grasp rate improves from 43% to 58%. Note that our baseline network that does not perform adversarial training has a grasp rate of only 47%. This clearly indicates that having extra supervision from adversarial agent is significantly more useful than just collecting more grasping data. What is interesting is the fact that 6K adversary examples lead to 52% grasp rate (iteration 1) where as 16K extra grasp examples only have 47% grasp rate. This clearly shows that in case of multiple robots, training via adversarial setting is a more beneficial strategy.

Finally, we used the model trained after competing with shaking adversary to further train it by competing against a snatching adversary. Adding iterations of adversarial training with the snatching adversary further improves the performance to 65%.

To stay closer to the baseline  [2], we increase the grasping force to the maximum possible and attach a rubber grip to the fingers similar to the one in  [2]. Instead of sampling 128 patches, 10 times more patches are sampled to ensure better coverage of the image space. The results for this can be seen in Table  II. Once again, the shaking adversarial framework (80%) beats the baseline (68%) handily. In the case of adding snatching adversary (82%), we see a small 2% improvement.

Object Grasping without adversary Grasping with adversary
Shake Adversary Snatch Adversary
Iteration-0 Iteration-1 Iteration-2 Iteration-0 Iteration-1
Tennis Pack 10 10 10 10 10 10
Hand Tool 4 3 3 3 4 3
Water Gun 1 4 3 5 8 7 8
Slingy Box 5 6 6 6 6 7
Plush Toy 4 0 3 4 1 5
Turtle Toy 2 2 3 2 1 3
Water Gun 2 4 4 4 7 8 9
Soap Bottle 6 7 9 9 8 10
Ring Toy 0 0 0 0 0 0
Foam Bottle 8 8 9 9 10 10
Overall 47% 43% 52% 58% 55% 65%
TABLE I: Grasping success (out of 10 tries) over iterations with low gripping force and few samples
Object Grasping without adversary Grasping with adversary
Shake Snatch
Tennis Pack 6 10 10
Hand Tool 10 6 6
Water Gun 1 5 8 8
Slingy Box 8 8 8
Plush Toy 2 6 6
Turtle Toy 4 4 6
Water Gun 2 3 8 8
Soap Bottle 10 10 10
Ring Toy 10 10 10
Foam Bottle 10 10 10
Overall 68% 80% 82%
TABLE II: Grasping success (out of 10 tries) with high gripping force and more samples

Vii Conclusion

Data-driven approaches in robotics have demonstrated significant improvements in recent years [1, 2, 11, 3, 4]. However, these recent approaches are data hungry, which often limits their applicability. We presented an adversarial self-supervised learning framework to help overcome this data issue. By pitting an adversary against an agent attempting to learn the core task, an agent is forced to learn robust solutions resulting in better and more efficient learning. We tested our approach on grasping problems to validate and evaluate its benefits. The result is a significant improvement over baseline in grasping of novel objects: an increase in overall grasp success rate to 82% (compared to 68% if no adversarial training is used). Even more dramatically, if we handicapped the grasping by reducing maximum force and contact friction, the method achieved 65% success rate (as compared to 47% if no adversarial training was used).


This work was supported by ONR MURI N000141612007, NSF IIS-1320083 and gift from Google.