Backdoors in DRL: Four Environments Focusing on In-distribution Triggers
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866914198933471232 |
|---|---|
| author | Ashcraft, Chace Staley, Ted Carney, Josh Hickert, Cameron Juba, Derek Karra, Kiran Drenkow, Nathan |
| author_facet | Ashcraft, Chace Staley, Ted Carney, Josh Hickert, Cameron Juba, Derek Karra, Kiran Drenkow, Nathan |
| contents | Backdoor attacks, or trojans, pose a security risk by concealing undesirable behavior in deep neural network models. Open-source neural networks are downloaded from the internet daily, possibly containing backdoors, and third-party model developers are common. To advance research on backdoor attack mitigation, we develop several trojans for deep reinforcement learning (DRL) agents. We focus on in-distribution triggers, which occur within the agent's natural data distribution, since they pose a more significant security threat than out-of-distribution triggers due to their ease of activation by the attacker during model deployment. We implement backdoor attacks in four reinforcement learning (RL) environments: LavaWorld, Randomized LavaWorld, Colorful Memory, and Modified Safety Gymnasium. We train various models, both clean and backdoored, to characterize these attacks. We find that in-distribution triggers can require additional effort to implement and be more challenging for models to learn, but are nevertheless viable threats in DRL even using basic data poisoning attacks. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2505_17248 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Backdoors in DRL: Four Environments Focusing on In-distribution Triggers Ashcraft, Chace Staley, Ted Carney, Josh Hickert, Cameron Juba, Derek Karra, Kiran Drenkow, Nathan Machine Learning Cryptography and Security Backdoor attacks, or trojans, pose a security risk by concealing undesirable behavior in deep neural network models. Open-source neural networks are downloaded from the internet daily, possibly containing backdoors, and third-party model developers are common. To advance research on backdoor attack mitigation, we develop several trojans for deep reinforcement learning (DRL) agents. We focus on in-distribution triggers, which occur within the agent's natural data distribution, since they pose a more significant security threat than out-of-distribution triggers due to their ease of activation by the attacker during model deployment. We implement backdoor attacks in four reinforcement learning (RL) environments: LavaWorld, Randomized LavaWorld, Colorful Memory, and Modified Safety Gymnasium. We train various models, both clean and backdoored, to characterize these attacks. We find that in-distribution triggers can require additional effort to implement and be more challenging for models to learn, but are nevertheless viable threats in DRL even using basic data poisoning attacks. |
| title | Backdoors in DRL: Four Environments Focusing on In-distribution Triggers |
| topic | Machine Learning Cryptography and Security |
| url | https://arxiv.org/abs/2505.17248 |