仅通过正常交互即可在强化学习中植入隐蔽后门，破坏训练效果。
Fox in the Henhouse: Supply-Chain Backdoor Attacks Against Reinforcement Learning
- 攻击者仅利用合法交互，无需直接访问模型参数或奖励信号。
- 仅污染3%训练数据，就能让90%触发动作失效，平均回报下降80%。
- 揭示了外部代理供应链中的安全风险，适合关注RL安全的研究者。
当前最先进的强化学习后门攻击依赖于不切实际的宽松访问假设，即攻击者可读取（甚至写入）受害者的策略参数、观测值或奖励。本文质疑这种强假设是否必要，提出供应链后门攻击（SCAB），针对一种常见的强化学习流程：使用外部代理进行训练，这些代理可能独立提供或嵌入环境。与以往工作不同，本攻击仅依赖强化学习代理与所提供代理的合法交互。尽管访问受限，仅通过污染3%的训练经验，攻击即可成功激活超过90%的触发动作，使受害者平均回合回报下降80%。该攻击表明，在不可信的强化学习训练供应链下，此类攻击极有可能成为现实。
原文摘要 · Abstract (English)
The current state-of-the-art backdoor attacks against Reinforcement Learning (RL) rely upon unrealistically permissive access models, that assume the attacker can read (or even write) the victim's policy parameters, observations, or rewards. In this work, we question whether such a strong assumption is required to launch backdoor attacks against RL. To answer this question, we propose the \underline{S}upply-\underline{C}h\underline{a}in \underline{B}ackdoor (SCAB) attack, which targets a common RL workflow: training agents using external agents that are provided separately or embedded within the environment. In contrast to prior works, our attack only relies on legitimate interactions of the RL agent with the supplied agents. Despite this limited access model, by poisoning a mere $3\%$ of training experiences, our attack can successfully activate over $90\%$ of triggered actions, reducing the average episodic return by $80\%$ for the victim. Our novel attack demonstrates that RL attacks are likely to become a reality under untrusted RL training supply-chains.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。