mlsanityData to 7 Oct 2026

BadRL: Sparse Targeted Backdoor Attack Against Reinforcement Learning

arXiv 2312.12585 ↗First posted 19 Dec 2023cs.LG cs.AI cs.CRcited by 29

Not on the map. Why?

Abstract (arXiv)

Backdoor attacks in reinforcement learning (RL) have previously employed intense attack strategies to ensure attack success. However, these methods suffer from high attack costs and increased detectability. In this work, we propose a novel approach, BadRL, which focuses on conducting highly sparse backdoor poisoning efforts during training and testing while maintaining successful attacks. Our algorithm, BadRL, strategically chooses state observations with high attack values to inject triggers during training and testing, thereby reducing the chances of detection. In contrast to the previous methods that utilize sample-agnostic trigger patterns, BadRL dynamically generates distinct trigger patterns based on targeted state observations, thereby enhancing its effectiveness. Theoretical analysis shows that the targeted backdoor attack is always viable and remains stealthy under specific assumptions. Empirical results on various classic RL tasks illustrate that BadRL can substantially degrade the performance of a victim agent with minimal poisoning efforts 0.003% of total training steps) during training and infrequent attacks during testing.

Key facts. Cited by 29 papers in the map (data through 7 Oct 2026). Builds on 12 of its 19 references that are in the map. First posted on arXiv 19 Dec 2023.

Builds on

12 of 19 references.

References · 12

  1. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  2. 2019Hidden Trigger Backdoor Attackscited by 359
  3. 2019Adversarial Policies: Attacking Deep Reinforcement Learningcited by 209
  4. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  5. 2020Adaptive Reward-Poisoning Attacks against Reinforcement Learningcited by 86
  6. 2020Policy Teaching via Environment Poisoning: Training-time Adversarial Attacks against Reinforcement Learningcited by 81
  7. 2021BACKDOORL: Backdoor Attack against Competitive Reinforcement Learningcited by 66
  8. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 58
  9. 2020Vulnerability-Aware Poisoning Mechanism for Online RL with Unknown Dynamicscited by 38
  10. 2019TrojDRL: Trojan Attacks on Deep Reinforcement Learning Agentscited by 29
  11. 2021Provably Efficient Black-Box Action Poisoning Attacks Against Reinforcement Learningcited by 29
  12. 2021Reward Poisoning in Reinforcement Learning: Attacks Against Unknown Learners in Unknown Environmentscited by 26

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 10; 2025: 9; 2026: 10.

29 papers.

Sort:

By area:

  1. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agentscited by 135
  2. 2024SleeperNets: Universal Backdoor Poisoning Attacks Against Reinforcement Learning Agentscited by 19
  3. 2026State Backdoor: Towards Stealthy Real-world Poisoning Attack on Vision-Language-Action Model in State Spacecited by 9
  4. 2024Adversarial Inception Backdoor Attacks against Reinforcement Learningcited by 8
  5. 2025BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Expertscited by 8
  6. 2025BLAST: A Stealthy Backdoor Leverage Attack against Cooperative Multi-Agent Deep Reinforcement Learning based Systemscited by 7
  7. 2025Persistent Backdoor Attacks under Continual Fine-Tuning of LLMscited by 7
  8. 2024Cooperative Backdoor Attack in Decentralized Reinforcement Learning with Theoretical Guaranteecited by 6
  9. 2024Recent Advances in Attack and Defense Approaches of Large Language Modelscited by 5
  10. 2025UNIDOOR: A Universal Framework for Action-Level Backdoor Attacks in Deep Reinforcement Learningcited by 5
  11. 2026TRAP: Tail-aware Ranking Attack for World-Model Planningcited by 4
  12. 2025Collaborative Shadows: Distributed Backdoor Attacks in LLM-Based Multi-Agent Systemscited by 3
17 more
  1. 2024Robust Deep Reinforcement Learning against Adversarial Behavior Manipulationcited by 2
  2. 2024Online Poisoning Attack Against Reinforcement Learning under Black-box Environmentscited by 2
  3. 2025TooBadRL: Trigger Optimization to Boost Effectiveness of Backdoor Attacks on Deep Reinforcement Learningcited by 2
  4. 2025TrojanTO: Action-Level Backdoor Attacks against Trajectory Optimization Modelscited by 2
  5. 2025PNAct: Crafting Backdoor Attacks in Safe Reinforcement Learningcited by 2
  6. 2024Which Experiences Are Influential for RL Agents? Efficiently Estimating The Influence of Experiencescited by 1
  7. 2025Beyond Training-time Poisoning: Component-level and Post-training Backdoors in Deep Reinforcement Learningcited by 1
  8. 2026Angel or Demon: Investigating the Plasticity Interventions' Impact on Backdoor Threats in Deep Reinforcement Learningcited by 1
  9. 2024A Disguised Wolf Is More Harmful Than a Toothless Tiger: Adaptive Malicious Code Injection Backdoor Attack Leveraging User Behavior as Triggerscited by 0
  10. 2024Trading Devil RL: Backdoor attack via Stock market, Bayesian Optimization and Reinforcement Learningcited by 0
  11. 2026CS-GBA: A Critical Sample-based Gradient-guided Backdoor Attack for Offline Reinforcement Learningcited by 0
  12. 2026When Backdoors Meet Partial Observability: Attacking Real-World Reinforcement Learningcited by 0
  13. 2026BehaviorGuard: Online Backdoor Defense for Deep Reinforcement Learningcited by 0
  14. 2026Plan2Cleanse: Test-Time Backdoor Defense via Monte-Carlo Planning in Deep Reinforcement Learningcited by 0
  15. 2026Target-Aware Interaction-Guided Reinforcement Learning for Black-Box Node Injection Attacks on Graph Neural Networkscited by 0
  16. 2026ORAN-DEFEND: Subspace Detection and Sanitization of Backdoor DRL xApps in Open RANcited by 0
  17. 2026Securing Autonomous Vehicle Systems via Twin-Aware Federated Reinforcement Learningcited by 0