mlsanityData to 14 Oct 2026

Backdoors in DRL: Four Environments Focusing on In-distribution Triggers

arXiv 2505.17248 ↗First posted 22 May 2025cs.LG cs.CRcited by 2

On the map: Deep reinforcement learning methods → Adversarial robustness and RL in finance

Abstract (arXiv)

Backdoor attacks, or trojans, pose a security risk by concealing undesirable behavior in deep neural network models. Open-source neural networks are downloaded from the internet daily, possibly containing backdoors, and third-party model developers are common. To advance research on backdoor attack mitigation, we develop several trojans for deep reinforcement learning (DRL) agents. We focus on in-distribution triggers, which occur within the agent's natural data distribution, since they pose a more significant security threat than out-of-distribution triggers due to their ease of activation by the attacker during model deployment. We implement backdoor attacks in four reinforcement learning (RL) environments: LavaWorld, Randomized LavaWorld, Colorful Memory, and Modified Safety Gymnasium. We train various models, both clean and backdoored, to characterize these attacks. We find that in-distribution triggers can require additional effort to implement and be more challenging for models to learn, but are nevertheless viable threats in DRL even using basic data poisoning attacks.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Adversarial robustness and RL in finance, one of 15 directions in Deep reinforcement learning methods. Builds on 23 of its 39 references that are in the map. First posted on arXiv 22 May 2025.

Builds on

23 of 39 references.

References · 23

  1. 2017Proximal Policy Optimization Algorithmscited by 15,215
  2. 2014Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translationcited by 4,057
  3. 2016Concrete Problems in AI Safetycited by 1,642
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  5. 2018Spectral Signatures in Backdoor Attackscited by 484
  6. 2023Minigrid & Miniworld: Modular & Customizable Reinforcement Learning Environments for Goal-Oriented Taskscited by 327
  7. 2017Adversarial Attacks on Neural Network Policiescited by 320
  8. 2019Adversarial Policies: Attacking Deep Reinforcement Learningcited by 214
  9. 2017Robust Deep Reinforcement Learning with Adversarial Attackscited by 154
  10. 2023Safety-Gymnasium: A Unified Safe Reinforcement Learning Benchmarkcited by 143
  11. 2021BACKDOORL: Backdoor Attack against Competitive Reinforcement Learningcited by 68
  12. 2020Stealthy and Efficient Adversarial Attacks against Deep Reinforcement Learningcited by 63
11 more
  1. 2020Stop-and-Go: Exploring Backdoor Attacks on Deep Reinforcement Learning-based Traffic Congestion Control Systemscited by 37
  2. 2022TrojViT: Trojan Insertion in Vision Transformerscited by 31
  3. 2019TrojDRL: Trojan Attacks on Deep Reinforcement Learning Agentscited by 30
  4. 2021Poisoning Deep Reinforcement Learning Agents with In-Distribution Triggerscited by 20
  5. 2022PolicyCleanse: Backdoor Detection and Mitigation in Reinforcement Learningcited by 19
  6. 2022Provable Defense against Backdoor Policies in Reinforcement Learningcited by 18
  7. 2022Towards A Critical Evaluation of Robustness for Deep Learning Backdoor Countermeasurescited by 11
  8. 2022Efficient Reward Poisoning Attacks on Online Deep Reinforcement Learningcited by 9
  9. 2021A Synergetic Attack against Neural Network Classifiers combining Backdoor and Adversarial Examplescited by 6
  10. 2022Attention Hijacking in Trojan Transformerscited by 6
  11. 2022Don't Watch Me: A Spatio-Temporal Trojan Attack on Deep-Reinforcement-Learning-Augment Autonomous Drivingcited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Safety in Embodied AI: A Survey of Risks, Attacks, and Defensescited by 7
  2. 2026CS-GBA: A Critical Sample-based Gradient-guided Backdoor Attack for Offline Reinforcement Learningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Beyond Training-time Poisoning: Component-level and Post-training Backdoors in Deep Reinforcement Learning
  2. 2024Mitigating Deep Reinforcement Learning Backdoors in the Neural Activation Space
  3. 2026When Backdoors Meet Partial Observability: Attacking Real-World Reinforcement Learning
  4. 2026BehaviorGuard: Online Backdoor Defense for Deep Reinforcement Learning
  5. 2022A Temporal-Pattern Backdoor Attack to Deep Reinforcement Learning
  6. 2025Fox in the Henhouse: Supply-Chain Backdoor Attacks Against Reinforcement Learning
  7. 2024SleeperNets: Universal Backdoor Poisoning Attacks Against Reinforcement Learning Agents
  8. 2023BadRL: Sparse Targeted Backdoor Attack Against Reinforcement Learning