mlsanityData to 14 Oct 2026

Temporal Logic-Based Multi-Vehicle Backdoor Attacks against Offline RL Agents in End-to-end Autonomous Driving

arXiv 2509.16950 ↗First posted 21 Sep 2025cs.CRcited by 4

On the map: LLM safety and security → Prompt injection and agent security

Abstract (arXiv)

Assessing the safety of autonomous driving (AD) systems against security threats, particularly backdoor attacks, is a stepping stone for real-world deployment. However, existing works mainly focus on pixel-level triggers that are impractical to deploy in the real world. We address this gap by introducing a novel backdoor attack against the end-to-end AD systems that leverage one or more other vehicles' trajectories as triggers. To generate precise trigger trajectories, we first use temporal logic (TL) specifications to define the behaviors of attacker vehicles. Configurable behavior models are then used to generate these trajectories, which are quantitatively evaluated and iteratively refined based on the TL specifications. We further develop a negative training strategy by incorporating patch trajectories that are similar to triggers but are designated not to activate the backdoor. It enhances the stealthiness of the attack and refines the system's responses to trigger scenarios. Through extensive experiments on 5 offline reinforcement learning (RL) driving agents with 6 trigger patterns and target action combinations, we demonstrate the flexibility and effectiveness of our proposed attack, showing the under-exploration of existing end-to-end AD systems' vulnerabilities to such trajectory-based backdoor attacks.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 60 of its 91 references that are in the map. First posted on arXiv 21 Sep 2025.

Builds on

60 of 91 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Physical Backdoor Attack can Jeopardize Driving with Vision-Large-Language Models19 Apr
  2. 2024Curiosity-driven Red-teaming for Large Language Models29 Feb

Other references · 58

  1. 2019nuScenes: A multimodal dataset for autonomous drivingcited by 4,523
  2. 2018Off-Policy Deep Reinforcement Learning without Explorationcited by 1,241
  3. 2022Planning-oriented Autonomous Drivingcited by 1,087
  4. 2023DriveGPT4: Interpretable End-to-end Autonomous Driving via Large Language Modelcited by 461
  5. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
  6. 2020TNT: Target-driveN Trajectory Predictioncited by 347
  7. 2021MetaDrive: Composing Diverse Driving Scenarios for Generalizable Reinforcement Learningcited by 290
  8. 2018Learning to Drive in a Daycited by 273
  9. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  10. 2019Adversarial Policies: Attacking Deep Reinforcement Learningcited by 214
  11. 2022Safety-Enhanced Autonomous Driving Using Interpretable Sensor Fusion Transformercited by 212
  12. 2021PandaSet: Advanced Sensor Suite Dataset for Autonomous Drivingcited by 190
38 more
  1. 2023Software Testing with Large Language Models: Survey, Landscape, and Visioncited by 166
  2. 2017Robust Deep Reinforcement Learning with Adversarial Attackscited by 154
  3. 2022Backdoor Defense via Decoupling the Training Processcited by 153
  4. 2019End-to-End Model-Free Reinforcement Learning for Urban Driving using Implicit Affordancescited by 149
  5. 2020Keep your Eyes on the Lane: Real-time Attention-guided Lane Detectioncited by 138
  6. 2021AdvSim: Generating Safety-Critical Scenarios for Self-Driving Vehiclescited by 137
  7. 2021Robust Reinforcement Learning on State Observations with Learned Optimal Adversarycited by 135
  8. 2022A Survey on Safety-Critical Driving Scenario Generation -- A Methodological Perspectivecited by 105
  9. 2022How to Backdoor Diffusion Models?cited by 104
  10. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 98
  11. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 95
  12. 2023ReasonNet: End-to-End Driving with Temporal and Global Reasoningcited by 93
  13. 2022On Adversarial Robustness of Trajectory Prediction for Autonomous Vehiclescited by 90
  14. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 83
  15. 2017Robust Physical-World Attacks on Deep Learning Modelscited by 72
  16. 2022COptiDICE: Offline Constrained Reinforcement Learning via Stationary Distribution Correction Estimationcited by 71
  17. 2023Constrained Decision Transformer for Offline Safe Reinforcement Learningcited by 69
  18. 2021BACKDOORL: Backdoor Attack against Competitive Reinforcement Learningcited by 68
  19. 2022SafeBench: A Benchmarking Platform for Safety Evaluation of Autonomous Vehiclescited by 66
  20. 2024A Survey on Autonomous Driving Datasets: Statistics, Annotation Quality, and a Future Outlookcited by 66
  21. 2021GRI: General Reinforced Imitation and its Application to Vision-Based Autonomous Drivingcited by 60
  22. 2023Datasets and Benchmarks for Offline Safe Reinforcement Learningcited by 59
  23. 2023Detecting Backdoors in Pre-trained Encoderscited by 55
  24. 2022AdvDO: Realistic Adversarial Attacks for Trajectory Predictioncited by 49
  25. 2024When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Searchcited by 47
  26. 2024DME-Driver: Integrating Human Decision Logic and 3D Scene Perception in Autonomous Drivingcited by 43
  27. 2020Stop-and-Go: Exploring Backdoor Attacks on Deep Reinforcement Learning-based Traffic Congestion Control Systemscited by 37
  28. 2022Physical Backdoor Attacks to Lane Detection Systems in Autonomous Drivingcited by 31
  29. 2023BadRL: Sparse Targeted Backdoor Attack Against Reinforcement Learningcited by 30
  30. 2021Offline Reinforcement Learning for Autonomous Driving with Safety and Exploration Enhancementcited by 29
  31. 2024Towards Robust Physical-world Backdoor Attacks on Lane Detectioncited by 26
  32. 2022BAFFLE: Hiding Backdoors in Offline Reinforcement Learning Datasetscited by 25
  33. 2024RL-JACK: Reinforcement Learning-powered Black-box Jailbreaking Attack against LLMscited by 23
  34. 2022Reward Poisoning Attacks on Offline Multi-Agent Reinforcement Learningcited by 20
  35. 2022PolicyCleanse: Backdoor Detection and Mitigation in Reinforcement Learningcited by 19
  36. 2023ParaFuzz: An Interpretability-Driven Technique for Detecting Poisoned Samples in NLPcited by 19
  37. 2019Requirements-driven Test Generation for Autonomous Vehicles with Machine Learning Componentscited by 18
  38. 2022Provable Defense against Backdoor Policies in Reinforcement Learningcited by 18

50 most cited of 58 All 58 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 4.

4 papers.

  1. 2026Angel or Demon: Investigating the Plasticity Interventions' Impact on Backdoor Threats in Deep Reinforcement Learningcited by 1
  2. 2026Unified Prediction and Planning via Conflict-Aware Disjoint Parameter Trainingcited by 1
  3. 2026VIPS: Vehicle-Infrastructure Cooperative Planning Benchmark via Pseudo-Simulationcited by 0
  4. 2026LogiC-Diff: Embedding Security Properties Into AI-Enabled Cyber-Physical Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2022Security of Deep Reinforcement Learning for Autonomous Driving: A Survey
  2. 2023Manipulating Trajectory Prediction with Backdoors
  3. 2026When Backdoors Meet Partial Observability: Attacking Real-World Reinforcement Learning
  4. 2023ReMAV: Reward Modeling of Autonomous Vehicles for Finding Likely Failure Events
  5. 2022Automatically Learning Fallback Strategies with Model-Free Reinforcement Learning in Safety-Critical Driving Scenarios
  6. 2026Securing Autonomous Vehicle Systems via Twin-Aware Federated Reinforcement Learning
  7. 2026BadDreamer: Transferable Backdoor Attacks against Video World Models for Autonomous Driving
  8. 2021Targeted Attack on Deep RL-based Autonomous Driving with Learned Visual Patterns