{"id":"https://openalex.org/W4415348335","doi":"https://doi.org/10.1609/aaai.v40i31.39809","title":"Beyond Training-time Poisoning: Component-level and Post-training Backdoors in Deep Reinforcement Learning","display_name":"Beyond Training-time Poisoning: Component-level and Post-training Backdoors in Deep Reinforcement Learning","publication_year":2025,"publication_date":"2025-07-07","ids":{"openalex":"https://openalex.org/W4415348335","doi":"https://doi.org/10.1609/aaai.v40i31.39809"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2507.04883","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2507.04883","pdf_url":"https://arxiv.org/pdf/2507.04883","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"type":"preprint","indexed_in":["arxiv"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2507.04883","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5109742722","display_name":"Sanyam Vyas","orcid":"https://orcid.org/0000-0002-5603-6868"},"institutions":[{"id":"https://openalex.org/I79510175","display_name":"Cardiff University","ror":"https://ror.org/03kk7td41","country_code":"GB","type":"education","lineage":["https://openalex.org/I79510175"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Vyas, Sanyam","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080813974","display_name":"Alberto Caron","orcid":"https://orcid.org/0000-0001-5643-2302"},"institutions":[{"id":"https://openalex.org/I4210128584","display_name":"The Alan Turing Institute","ror":"https://ror.org/035dkdb55","country_code":"GB","type":"facility","lineage":["https://openalex.org/I4210128584"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Caron, Alberto","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5012044459","display_name":"Chris Hicks","orcid":"https://orcid.org/0000-0001-8628-6772"},"institutions":[{"id":"https://openalex.org/I4210128584","display_name":"The Alan Turing Institute","ror":"https://ror.org/035dkdb55","country_code":"GB","type":"facility","lineage":["https://openalex.org/I4210128584"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Hicks, Chris","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5090436792","display_name":"Pete Burnap","orcid":"https://orcid.org/0000-0003-0396-633X"},"institutions":[{"id":"https://openalex.org/I79510175","display_name":"Cardiff University","ror":"https://ror.org/03kk7td41","country_code":"GB","type":"education","lineage":["https://openalex.org/I79510175"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Burnap, Pete","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5008006072","display_name":"Vasilios Mavroudis","orcid":"https://orcid.org/0000-0003-2667-5906"},"institutions":[{"id":"https://openalex.org/I4210128584","display_name":"The Alan Turing Institute","ror":"https://ror.org/035dkdb55","country_code":"GB","type":"facility","lineage":["https://openalex.org/I4210128584"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Mavroudis, Vasilios","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9290000200271606,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9290000200271606,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9993000030517578},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6535999774932861},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6381000280380249},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.5210999846458435},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.46160000562667847},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.3797000050544739}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9993000030517578},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6693000197410583},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6535999774932861},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6381000280380249},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.579200029373169},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.5210999846458435},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.46160000562667847},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4228000044822693},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.3797000050544739},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.29660001397132874},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2962999939918518},{"id":"https://openalex.org/C2777610993","wikidata":"https://www.wikidata.org/wiki/Q3433064","display_name":"Riprap","level":2,"score":0.27459999918937683},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.2660999894142151}],"mesh":[],"locations_count":3,"locations":[{"id":"pmh:oai:arXiv.org:2507.04883","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2507.04883","pdf_url":"https://arxiv.org/pdf/2507.04883","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:https://orca.cardiff.ac.uk:182861","is_oa":false,"landing_page_url":"https://orca.cardiff.ac.uk/id/eprint/182861/1/aaai2026_btt_camera_ready___%20%281%29.pdf","pdf_url":null,"source":{"id":"https://openalex.org/S4306401195","display_name":"ORCA Online Research @Cardiff (Cardiff University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I79510175","host_organization_name":"Cardiff University","host_organization_lineage":["https://openalex.org/I79510175"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"PeerReviewed"},{"id":"pmh:oai:ojs.aaai.org:article/39809","is_oa":false,"landing_page_url":"https://ojs.aaai.org/index.php/AAAI/article/view/39809","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"2159-5399","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2507.04883","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2507.04883","pdf_url":"https://arxiv.org/pdf/2507.04883","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Deep":[0],"Reinforcement":[1],"Learning":[2],"(DRL)":[3],"systems":[4],"are":[5],"increasingly":[6],"used":[7],"in":[8,35],"safety-critical":[9],"applications,":[10],"yet":[11],"their":[12],"security":[13],"remains":[14],"severely":[15],"underexplored.":[16],"This":[17],"work":[18],"investigates":[19],"backdoor":[20,41,91,102,128,147],"attacks,":[21],"which":[22,83,104],"implant":[23,88],"hidden":[24],"triggers":[25],"that":[26,92,140],"cause":[27],"malicious":[28],"actions":[29],"only":[30],"when":[31],"specific":[32],"inputs":[33],"appear":[34],"the":[36,52,62,152,158],"observation":[37],"space.":[38],"Existing":[39],"DRL":[40,63,146],"research":[42,154],"focuses":[43],"solely":[44],"on":[45],"training-time":[46,127],"attacks":[47,124,129],"requiring":[48],"unrealistic":[49],"access":[50,107],"to":[51,87,108],"training":[53],"pipeline.":[54],"In":[55],"contrast,":[56],"we":[57],"reveal":[58],"critical":[59],"vulnerabilities":[60],"across":[61,118],"supply":[64],"chain":[65],"where":[66],"backdoors":[67],"can":[68],"be":[69],"embedded":[70],"with":[71],"significantly":[72],"reduced":[73],"adversarial":[74,135],"privileges.":[75],"We":[76,137],"introduce":[77],"two":[78,144],"novel":[79],"attacks:":[80],"(1)":[81],"TrojanentRL,":[82],"exploits":[84],"component-level":[85],"flaws":[86],"a":[89,100],"persistent":[90],"survives":[93],"full":[94],"model":[95],"retraining;":[96],"and":[97,115,156],"(2)":[98],"InfrectroRL,":[99],"post-training":[101],"attack":[103],"requires":[105],"no":[106],"training,":[109],"validation,":[110],"nor":[111],"test":[112],"data.":[113],"Empirical":[114],"analytical":[116],"evaluations":[117],"six":[119],"Atari":[120],"environments":[121],"show":[122],"our":[123],"rival":[125],"state-of-the-art":[126],"while":[130],"operating":[131],"under":[132],"much":[133],"stricter":[134],"constraints.":[136],"also":[138],"demonstrate":[139],"InfrectroRL":[141],"further":[142],"evades":[143],"leading":[145],"defenses.":[148,163],"These":[149],"findings":[150],"challenge":[151],"current":[153],"focus":[155],"highlight":[157],"urgent":[159],"need":[160],"for":[161],"robust":[162]},"counts_by_year":[],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-20T00:00:00"}