mlsanityData to 14 Oct 2026

Fox in the Henhouse: Supply-Chain Backdoor Attacks Against Reinforcement Learning

arXiv 2505.19532 ↗First posted 26 May 2025cs.LGcited by 5

On the map: Deep reinforcement learning methods → Adversarial robustness and RL in finance

Abstract (arXiv)

The current state-of-the-art backdoor attacks against Reinforcement Learning (RL) rely upon unrealistically permissive access models, that assume the attacker can read (or even write) the victim's policy parameters, observations, or rewards. In this work, we question whether such a strong assumption is required to launch backdoor attacks against RL. To answer this question, we propose the underlineSupply-underlineChunderlineain underlineBackdoor (SCAB) attack, which targets a common RL workflow: training agents using external agents that are provided separately or embedded within the environment. In contrast to prior works, our attack only relies on legitimate interactions of the RL agent with the supplied agents. Despite this limited access model, by poisoning a mere 3% of training experiences, our attack can successfully activate over 90% of triggered actions, reducing the average episodic return by 80% for the victim. Our novel attack demonstrates that RL attacks are likely to become a reality under untrusted RL training supply-chains.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Placed in Adversarial robustness and RL in finance, one of 15 directions in Deep reinforcement learning methods. Builds on 43 of its 61 references that are in the map. First posted on arXiv 26 May 2025.

Builds on

43 of 61 references.

References · 43

  1. 2013Playing Atari with Deep Reinforcement Learningcited by 3,274
  2. 2017CARLA: An Open Urban Driving Simulatorcited by 2,449
  3. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  5. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  6. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  7. 2016Safe, Multi-Agent, Reinforcement Learning for Autonomous Drivingcited by 311
  8. 2023Cal-QL: Calibrated Offline RL Pre-Training for Efficient Online Fine-Tuningcited by 237
  9. 2020PettingZoo: Gym for Multi-Agent Reinforcement Learningcited by 220
  10. 2023Guiding Pretraining in Reinforcement Learning with Large Language Modelscited by 187
  11. 2017Neural Trojanscited by 153
  12. 2019CityFlow: A Multi-Agent Reinforcement Learning Environment for Large Scale City Traffic Scenariocited by 115
31 more
  1. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 89
  2. 2020Policy Teaching via Environment Poisoning: Training-time Adversarial Attacks against Reinforcement Learningcited by 81
  3. 2019Policy Poisoning in Batch Reinforcement Learning and Controlcited by 70
  4. 2021BACKDOORL: Backdoor Attack against Competitive Reinforcement Learningcited by 68
  5. 2020Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attackscited by 61
  6. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 59
  7. 2022Taxonomy of Attacks on Open-Source Software Supply Chainscited by 58
  8. 2021Policy Smoothing for Provably Robust Reinforcement Learningcited by 40
  9. 2020Vulnerability-Aware Poisoning Mechanism for Online RL with Unknown Dynamicscited by 38
  10. 2020Stop-and-Go: Exploring Backdoor Attacks on Deep Reinforcement Learning-based Traffic Congestion Control Systemscited by 37
  11. 2019ABIDES: Towards High-Fidelity Market Simulation for AI Researchcited by 32
  12. 2021Offline Pre-trained Multi-Agent Decision Transformer: One Big Sequence Model Tackles All SMAC Taskscited by 32
  13. 2021Provably Efficient Black-Box Action Poisoning Attacks Against Reinforcement Learningcited by 29
  14. 2022BAFFLE: Hiding Backdoors in Offline Reinforcement Learning Datasetscited by 25
  15. 2019Design of intentional backdoors in sequential modelscited by 21
  16. 2022Understanding the Limits of Poisoning Attacks in Episodic Reinforcement Learningcited by 21
  17. 2021Poisoning Deep Reinforcement Learning Agents with In-Distribution Triggerscited by 20
  18. 2022Provable Defense against Backdoor Policies in Reinforcement Learningcited by 18
  19. 2022A Temporal-Pattern Backdoor Attack to Deep Reinforcement Learningcited by 16
  20. 2020A Conceptual Framework for Externally-influenced Agents: An Assisted Reinforcement Learning Reviewcited by 15
  21. 2022Double Bubble, Toil and Trouble: Enhancing Certified Robustness through Transitivitycited by 15
  22. 2023Implicit Poisoning Attacks in Two-Agent Reinforcement Learning: Adversarial Policies for Training-Time Attackscited by 14
  23. 2024A Large-Scale Exploit Instrumentation Study of AI/ML Supply Chain Attacks in Hugging Face Modelscited by 14
  24. 2024Architectural Neural Backdoors from First Principlescited by 11
  25. 2024Language Guided Exploration for RL Agents in Text Environmentscited by 9
  26. 2024What do we know about Hugging Face? A systematic literature review and quantitative validation of qualitative claimscited by 9
  27. 2025Demystifying LLM Supply Chain Vulnerabilities in the Wild: Distribution, Root Cause, and Real-World Impactcited by 8
  28. 2023Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attackscited by 6
  29. 2023Et Tu Certifications: Robustness Certificates Yield Better Adversarial Examplescited by 4
  30. 2023It's Simplex! Disaggregating Measures to Improve Certified Robustnesscited by 4
  31. 2022Backdoor Attacks on Multiagent Collaborative Systemscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 3.

5 papers.

  1. 2025Agent Safety Alignment via Reinforcement Learningcited by 11
  2. 2025Position: Certified Robustness Does Not (Yet) Imply Model Securitycited by 4
  3. 2026Angel or Demon: Investigating the Plasticity Interventions' Impact on Backdoor Threats in Deep Reinforcement Learningcited by 1
  4. 2026BehaviorGuard: Online Backdoor Defense for Deep Reinforcement Learningcited by 0
  5. 2026Plan2Cleanse: Test-Time Backdoor Defense via Monte-Carlo Planning in Deep Reinforcement Learningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Beware Untrusted Simulators -- Reward-Free Backdoor Attacks in Reinforcement Learning
  2. 2024SleeperNets: Universal Backdoor Poisoning Attacks Against Reinforcement Learning Agents
  3. 2025Exposing Vulnerabilities in RL: A Novel Stealthy Backdoor Attack through Reward Poisoning ↗
  4. 2025Beyond Training-time Poisoning: Component-level and Post-training Backdoors in Deep Reinforcement Learning
  5. 2024Mitigating Deep Reinforcement Learning Backdoors in the Neural Activation Space
  6. 2025PNAct: Crafting Backdoor Attacks in Safe Reinforcement Learning
  7. 2023BadRL: Sparse Targeted Backdoor Attack Against Reinforcement Learning
  8. 2026When Backdoors Meet Partial Observability: Attacking Real-World Reinforcement Learning