Research map / Reinforcement learning / Visual and representation RL
SHINE: Shielding Backdoors in Deep Reinforcement Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SHINE, a testing-phase backdoor shielding method for deep RL agents that restores the trigger via step-level (EDGE) and feature-level mask explanations and then retrains the policy with a KL-constrained PPO-style objective.
Problem
Backdoor attacks on pretrained deep RL agents (perturbation-based and adversarial-agent attacks) force suboptimal actions when a trigger appears; existing defenses target supervised classifiers or need a clean environment or handle only one attack type.
Approach
Identify the backdoor trigger from the agent's failed trajectories by combining a step-level explanation (EDGE) with a learned feature-level Bernoulli mask that keeps the features needed to reproduce the agent's action, then retrain the agent with a KL-constrained objective in the operating environment, with theoretical bounds on performance in clean and poisoned environments, without requiring a
Key results
- Trigger restoration F1 of SHINE reaches 0.998 on Pong and 0.997 on Breakout, versus 0.268 for NC and 0.936 for FeatureRE on Pong.
- On Pong under the targeted TrojDRL attack, SHINE raises the operating-environment score from -0.010 to 0.728, versus 0.032 for direct retraining and 0.624 for STRIP.
- Clean-agent shielding with SHINE keeps performance within noise, e.g. Pong clean-environment score 0.778 before vs 0.769 after shielding.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply SHINE shielding and retraining to the backdoored agent | Backdoored agent · Pong, operating | average score: -0.010±0.001 -> 0.728±0.027 | Helped |
| Apply SHINE shielding and retraining to the backdoored agent | Backdoored agent · Breakout, operating | average score: 16.40±0.48 -> 28.63±2.05 | Helped |
| Apply SHINE shielding and retraining to the backdoored agent | Backdoored agent · Space Invaders, operating | average score: 108.3±2.9 -> 832.9±7.5 | Helped |
| Apply SHINE shielding and retraining to the backdoored agent | Backdoored agent · QMIX, operating | winning rate: 62.0±0.7 -> 99.1±0.8 | Helped |
| Apply SHINE shielding and retraining to the backdoored agent | Backdoored agent · COMA, operating | winning rate: 17.9±0.4 -> 92.3±1.2 | Helped |
| Apply SHINE shielding and retraining to the backdoored agent | Backdoored agent · You-Shall-Not-Pass, operating | winning rate: 10.4±0.2 -> 48.2±1.8 | Helped |
| Apply SHINE shielding and retraining to the backdoored agent | Backdoored agent · Sumo-Humans, operating | winning rate: 16.2±0.2 -> 32.4±1.3 | Helped |
| Apply SHINE shielding and retraining to the backdoored agent | Backdoored agent · Run-to-Go-Ants, operating | winning rate: 16.2±0.2 -> 52.4±0.6 | Helped |
| Apply SHINE shielding to a clean agent | Clean agent · Pong, clean | average score: 0.778±0.067 -> 0.769±0.089 | No clear effect |
| Apply SHINE shielding to a clean agent | Clean agent · Breakout, clean | average score: 27.50±1.32 -> 26.27±0.64 | No clear effect |
| Apply SHINE shielding to a clean agent | Clean agent · Space Invaders, clean | average score: 836.4±3.2 -> 838.2±3.4 | No clear effect |
| Apply SHINE shielding to a clean agent | Clean agent · QMIX, clean | winning rate: 99.8±0.1 -> 99.6±0.1 | No clear effect |
Surprising findings
- Shielded agents sometimes perform better than the original agent in the clean environment, which the authors attribute to retraining improving generalizability.
- Direct retraining without trigger identification degrades clean-environment performance (Pong 0.680 to 0.286).
Limitations
- Postmortem defense: shielding only occurs after the backdoor has been triggered and caused damage.
- Adaptive attacks with dynamic trigger locations or attacks on the explanation method are not fully addressed; only a limited adaptive attack was tried.
- Evaluated only on Atari, SMAC, and MuJoCo environments with a single trigger per attack; not extended to extensive-form or competitive multi-agent games.
Experimental setup
Datasets: Atari Pong Atari Breakout Atari Space Invaders SMAC MuJoCo You-Shall-Not-Pass MuJoCo Sumo-Humans MuJoCo Run-to-Go-Ants
Benchmarks: Atari Pong Atari Breakout Atari Space Invaders SMAC You-Shall-Not-Pass Sumo-Humans Run-to-Go-Ants
Metrics: F1 trigger restoration fidelity average score average winning rate precision recall
Baselines: Neural Cleanse (NC) FeatureRE STRIP Direct retraining
Builds on: EDGE TrojDRL BackdooRL PPO Neural Cleanse
Closest papers by meaning
- PolicyGuard: Towards Test-time and Step-level Adversary Defense for Reinforcement Learning Agent (ICML 2026 · similarity 0.89)
- BadRL: Sparse Targeted Backdoor Attack against Reinforcement Learning (AAAI 2024 · similarity 0.89)
- Adversarial Inception Backdoor Attacks against Reinforcement Learning (ICML 2025 · similarity 0.87)
- Universal Jailbreak Backdoors from Poisoned Human Feedback (ICLR 2024 · similarity 0.85)
- Stealthy Imitation: Reward-guided Environment-free Policy Stealing (ICML 2024 · similarity 0.85)
- Correlated Proxies: A New Definition and Improved Mitigation for Reward Hacking (ICLR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.