Research map / Adversarial robustness and security / Backdoor and poisoning
Temporal Logic-Based Multi-Vehicle Backdoor Attacks against Offline RL Agents in End-to-end Autonomous Driving
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a backdoor attack on offline-RL end-to-end driving agents in MetaDrive, using multi-vehicle trajectories (generated via temporal logic specifications over behavior models) as triggers, plus negative "patch" trajectories to reduce false activation.
Problem
Existing backdoor attacks on autonomous driving use pixel-level patch triggers that are hard to deploy physically; the paper targets realistic trajectory-based triggers from other vehicles against end-to-end RL driving policies trained offline.
Approach
Define trigger behaviors with signal temporal logic (Reach/Avoid/Stay predicates), generate attacker-vehicle trajectories with rule-based behavior models (overtake, brake) and iteratively perturb configurations until the TL score is positive, then poison offline data with the trigger and negative patch trajectories whose TL scores fall below a threshold.
Key results
- On MetaDrive easy tasks with CopTiDICE, sync-bypass trigger reduces poisoned reward from 388.06 (clean) to 8.23 and raises poisoned MVR to 1.00.
- Across BC, BCQ, and CopTiDICE, poisoned MVR reaches up to 1.00 while benign MVR stays low (e.g., 0.00 on easy CopTiDICE).
- Without negative training, the non-trigger MVR for the poisoned agent reaches 100% (F-MVR), showing false activation is removed by negative training.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add multi-vehicle Sync-bypass trigger poisoning | Coptidice · MetaDrive Easy, Medium, and Hard | MVR: 0.00 -> 1.00; 0.23 -> 1.00; 0.18 -> 1.00 | Helped |
| Use the Sync-bypass trigger rather than the more complex Brake-overtake trigger | Coptidice backdoor · MetaDrive tasks across Easy, Medium, and Hard | poisoned reward: Easy: 130.98 -> 8.23; Medium: 69.26 -> 42.58; Hard: 76.12 -> 82.46 | Helped |
| Replace Coptidice with BC as the victim algorithm | Backdoor attack · MetaDrive Hard | poisoned MVR: 1.00 -> 0.31 | Hurt |
| Add patch trajectories through negative training (ablation) | Backdoored Coptidice · Similar but non-trigger trajectories | false-trigger MVR | Helped |
| Add patch trajectories through negative training (ablation) | Backdoored Coptidice · MetaDrive Easy, Medium, and Hard | triggered MVR: Easy Sync-bypass: 1.00 -> 1.00; Medium: 1.00 -> 1.00; Hard: 1.00 -> 1.00 | No clear effect |
| Increase poisoning rate (ablation) | Backdoored offline RL agents · MetaDrive Hard | poisoned MVR | Helped |
| Increase poisoning rate (ablation) | Backdoored offline RL agents · MetaDrive Hard, no trigger | benign reward | Hurt |
| Vary attacker vehicle dynamics model from default to small, medium, or large (ablation) | Coptidice backdoor · MetaDrive Easy | poisoned MVR: 1.00; 1.00; 0.97 | No clear effect |
| Change negative-training TL threshold from -15 to -10 (ablation) | Coptidice backdoor · MetaDrive Easy, Sync-bypass | poisoned MVR: 1.00 -> 0.91 | Hurt |
| Include more patch trajectories by raising the TL threshold (ablation) | Coptidice backdoor · MetaDrive tasks | poisoned MVR | Hurt |
| Increase the number of attacker vehicles (ablation) | Backdoored agents · MetaDrive trigger scenarios | poisoned MVR | Hurt |
| Increase the number of attacker vehicles (ablation) | Backdoored agents · MetaDrive without trigger | benign reward | No clear effect |
Surprising findings
- Simpler sync-bypass trigger is more effective than the more complex brake-overtake trigger under the same poisoning rate.
- DP-SGD defense fails to prevent crashes (P-MVR stays 1.00), while smoothing is weaker against left-turn target actions.
Limitations
- Only one atomic TL proposition (region reach within time window) is used, limiting specification expressiveness.
- Evaluated only on RL-based driving agents in MetaDrive simulator, not module-based or full-stack AD systems.
- Complex triggers are harder to inject and require higher poisoning rates.
Experimental setup
Datasets: MetaDrive offline driving data NGSIM
Benchmarks: MetaDrive easy/medium/hard tasks
Metrics: cumulative reward ADE mission violation rate (MVR)
Baselines: BC BCQ BC-safe CDT trajectory smoothing DP-SGD
Builds on: CopTiDICE BCQ behavior cloning DiffSpec STLpy
Closest papers by meaning
- Adversarial Backdoor Attack by Naturalistic Data Poisoning on Trajectory Prediction in Autonomous Driving (CVPR 2024 · similarity 0.88)
- PolicyGuard: Towards Test-time and Step-level Adversary Defense for Reinforcement Learning Agent (ICML 2026 · similarity 0.85)
- BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization (NeurIPS 2025 · similarity 0.85)
- RAD: Training an End-to-End Driving Policy via Large-Scale 3DGS-based Reinforcement Learning (NeurIPS 2025 · similarity 0.85)
- AutoVLA: A Vision-Language-Action Model for End-to-End Autonomous Driving with Adaptive Reasoning and Reinforcement Fine-Tuning (NeurIPS 2025 · similarity 0.84)
- Distill to Think, Foresee to Act: Cognitive-Physical Reinforcement Learning for Autonomous Driving (NeurIPS 2026 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.