mlsanityData to 7 Oct 2026

TooBadRL: Trigger Optimization to Boost Effectiveness of Backdoor Attacks on Deep Reinforcement Learning

arXiv 2506.09562 ↗First posted 11 Jun 2025cs.CR cs.LGcited by 2

Not on the map. Why?

Abstract (arXiv)

Deep reinforcement learning (DRL) has achieved remarkable success in a wide range of sequential decision-making applications, including robotics, healthcare, smart grids, and finance. Recent studies reveal that adversaries can implant backdoors into DRL agents during the training phase. These backdoors can later be activated by specific triggers during deployment, compelling the agent to execute targeted actions and potentially leading to severe consequences, such as drone crashes or vehicle collisions. However, existing backdoor attacks utilize simplistic and heuristic trigger configurations, overlooking the critical impact of trigger design on attack effectiveness. To address this gap, we introduce TooBadRL, the first framework to systematically optimize DRL backdoor triggers across three critical aspects: injection timing, trigger dimension, and manipulation magnitude. Specifically, we first introduce a performance-aware adaptive freezing mechanism to determine the injection timing during training. Then, we formulate trigger selection as an influence attribution problem and apply Shapley value analysis to identify the most influential trigger dimension for injection. Furthermore, we propose an adversarial input synthesis method to optimize the manipulation magnitude under environmental constraints. Extensive evaluations on three DRL algorithms and nine benchmark tasks demonstrate that TooBadRL outperforms five baseline methods in terms of attack success rate while only slightly affecting normal task performance. We further evaluate potential defense strategies from detection and mitigation perspectives. We open-source our code to facilitate reproducibility and further research.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 32 of its 60 references that are in the map. First posted on arXiv 11 Jun 2025.

Builds on

32 of 60 references.

References · 32

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2017Proximal Policy Optimization Algorithmscited by 14,441
  3. 2017A Unified Approach to Interpreting Model Predictionscited by 6,488
  4. 2015Trust Region Policy Optimizationcited by 2,503
  5. 2016Asynchronous Methods for Deep Reinforcement Learningcited by 2,218
  6. 2016OpenAI Gymcited by 1,684
  7. 2018How To Backdoor Federated Learningcited by 745
  8. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  9. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  10. 2018Deep Reinforcement Learning for Multi-Agent Systems: A Review of Challenges, Solutions and Applicationscited by 122
  11. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
  12. 2020Graph Backdoorcited by 112
20 more
  1. 2019Deep Reinforcement Learning for Cyber Securitycited by 92
  2. 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
  3. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  4. 2021BACKDOORL: Backdoor Attack against Competitive Reinforcement Learningcited by 66
  5. 2018Crafting a Toolchain for Image Restoration by Deep Reinforcement Learningcited by 45
  6. 2023Unnoticeable Backdoor Attacks on Graph Neural Networkscited by 45
  7. 2020Stop-and-Go: Exploring Backdoor Attacks on Deep Reinforcement Learning-based Traffic Congestion Control Systemscited by 35
  8. 2023BadRL: Sparse Targeted Backdoor Attack Against Reinforcement Learningcited by 29
  9. 2022BAFFLE: Hiding Backdoors in Offline Reinforcement Learning Datasetscited by 24
  10. 2019Design of intentional backdoors in sequential modelscited by 20
  11. 2021Poisoning Deep Reinforcement Learning Agents with In-Distribution Triggerscited by 19
  12. 2024SleeperNets: Universal Backdoor Poisoning Attacks Against Reinforcement Learning Agentscited by 19
  13. 2022A Temporal-Pattern Backdoor Attack to Deep Reinforcement Learningcited by 15
  14. 2024Distributed Backdoor Attacks on Federated Graph Learning and Certified Defensescited by 15
  15. 2022Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifierscited by 14
  16. 2021Resilient Machine Learning for Networked Cyber Physical Systems: A Survey for Machine Learning Security to Securing Machine Learning for CPScited by 10
  17. 2020Can a Robot Trust You? A DRL-Based Approach to Trust-Driven Human-Guided Navigationcited by 6
  18. 2024A Spatiotemporal Stealthy Backdoor Attack against Cooperative Multi-Agent Deep Reinforcement Learningcited by 6
  19. 2025UNIDOOR: A Universal Framework for Action-Level Backdoor Attacks in Deep Reinforcement Learningcited by 5
  20. 2022Reachability Verification Based Reliability Assessment for Deep Reinforcement Learning Controlled Robotics and Autonomous Systemscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 1.

2 papers.

  1. 2025TrojanTO: Action-Level Backdoor Attacks against Trajectory Optimization Modelscited by 2
  2. 2026Angel or Demon: Investigating the Plasticity Interventions' Impact on Backdoor Threats in Deep Reinforcement Learningcited by 1