Research map / Adversarial robustness and security / Backdoor and poisoning
BadRL: Sparse Targeted Backdoor Attack against Reinforcement Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes BadRL, a sparse, targeted backdoor attack on deep RL agents that poisons only high attack-value states during training and testing, using sample-specific triggers tuned by mutual information of gradients.
Problem
Existing backdoor attacks on reinforcement learning use intense, frequent poisoning during training and consecutive triggers at test time, which is costly and easily detected. The paper targets highly sparse yet effective targeted backdoor attacks on RL agents.
Approach
Select states with high attack value (Q* gap between optimal and target action) for trigger injection, generate sample-specific triggers by maximizing mutual information between clean and poisoned policy gradients, and perturb actions and rewards only at the current step under a poisoning budget.
Key results
- BadRL reaches 100% ASR on all four Atari tasks with 0.002-0.003% poisoning of training steps, versus 26.78% ASR for TrojDRL on Breakout.
- On Breakout BadRL achieves 84.90% AER at 0.47% test-time sparsity, compared with 3.13% AER and 1.04% sparsity for TrojDRL.
- Neural Cleanse fails to detect the BadRL trigger and RL sanitization does not prevent trigger activation on Breakout.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use mutual-information trigger tuning instead of cross-entropy tuning | BadRL · Breakout | AER: 84.90% vs 20.13% | Helped |
| Use mutual-information trigger tuning instead of cross-entropy tuning | BadRL · Pong | AER: 100.00% vs 59.29% | Helped |
| Use mutual-information trigger tuning instead of cross-entropy tuning | BadRL · Qbert | AER: 75.88% vs 58.05% | Helped |
| Use mutual-information trigger tuning instead of cross-entropy tuning | BadRL · SpaceInvaders | AER: 76.13% vs 49.68% | Helped |
| Remove mutual-information trigger tuning (ablation) | BadRL-S · Breakout (0.003% poisoning) | ASR: 100.00±0.00% -> 3.99±6.42% | Hurt |
| Remove mutual-information trigger tuning (ablation) | BadRL-S · Breakout (0.003% poisoning) | AER: 84.90±3.59% -> 1.21±2.42% | Hurt |
| Remove action modification (ablation) | BadRL-S · Breakout (0.003% poisoning) | ASR: 100.00±0.00% -> 87.56±6.83% | Hurt |
| Remove action modification (ablation) | BadRL-S · Breakout (0.003% poisoning) | AER: 84.90±3.59% -> 78.77±6.15% | Hurt |
Surprising findings
- Naive attack-value-based selection with a CE-loss trigger (BadRL-CE) achieves only 0.43% ASR on Breakout despite similar poisoning effort, showing the trigger tuning matters.
Limitations
- Evaluated only on four Atari games with a single victim setup.
- Assumes unique optimal action at targeted states for the feasibility theorem; the attacker needs a simulator to estimate Q*.
Experimental setup
Datasets: Pong Breakout Qbert SpaceInvaders
Benchmarks: Pong Breakout Qbert SpaceInvaders
Metrics: CDA AER ASR Attack Sparsity
Baselines: TrojDRL BadRL-CE BadRL-M BadRL-W
Builds on: TrojDRL Neural Cleanse RL sanitization
Closest papers by meaning
- PolicyGuard: Towards Test-time and Step-level Adversary Defense for Reinforcement Learning Agent (ICML 2026 · similarity 0.90)
- Adversarial Inception Backdoor Attacks against Reinforcement Learning (ICML 2025 · similarity 0.89)
- SHINE: Shielding Backdoors in Deep Reinforcement Learning (ICML 2024 · similarity 0.89)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.87)
- Is Poisoning a Real Threat to DPO? Maybe More So Than You Think (AAAI 2025 · similarity 0.87)
- Optimal Attack and Defense for Reinforcement Learning (AAAI 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.