用可打印贴纸触发，让机器人在真实环境里执行恶意动作。
When Backdoors Meet Partial Observability: Attacking Real-World Reinforcement Learning
- 用扩散模型生成随机贴纸位置，适应不可控的传感器数据变化。
- 只在关键决策点注入攻击，正常任务性能不变。
- 实测在真实机器人上有效，适合研究现实世界强化学习安全。
后门攻击可使强化学习（RL）策略在干净输入下正常运行，而在触发器存在时执行恶意行为。现有RL后门攻击多在仿真中研究，且假设攻击者能完全控制影响策略的观测输入。这一假设在真实部署中失效，因RL策略常依赖多模态观测，攻击者虽能通过物理触发器操控视觉输入，但激光雷达和里程计等辅助状态无法控制且随轨迹变化。本文研究此被忽视的问题，提出一种扩散引导的后门攻击框架（DGBA），使用小型可打印视觉贴纸作为触发器，并通过条件扩散模型学习随机触发分布，以在不同不可控状态下保持攻击一致性。此外，引入基于优势的投毒策略，仅在决策关键训练状态注入触发器。在物理TurtleBot3平台上实验表明，DGBA持续优于现有方法，同时维持正常任务性能。演示视频与代码见附录。
原文摘要 · Abstract (English)
Backdoor attacks can cause reinforcement learning (RL) policies to behave normally under clean inputs while executing malicious behaviors when triggers are present. Existing RL backdoor attacks are primarily studied in simulation and often assume that attackers can reliably manipulate the observations driving policy decisions. This assumption becomes fragile in real-world deployment, where RL policies commonly rely on multimodal observations. Attackers can manipulate visual inputs through physical triggers, but auxiliary states such as LiDAR and odometry signals remain uncontrollable and vary across trajectories. We study this overlooked challenge and propose a diffusion-guided backdoor attack framework (DGBA) for real-world RL. DGBA uses small printable visual patches as triggers and learns a stochastic trigger distribution via conditional diffusion to maintain consistent attack activation under varying uncontrollable states. We further introduce an advantage-based poisoning strategy that injects triggers only at decision-critical training states. Experiments on a physical TurtleBot3 platform show that DGBA consistently outperforms prior RL backdoor attacks while preserving normal task performance. Demo videos and code are available in the supplementary material.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。