Fox in the Henhouse: Supply-Chain Backdoor Attacks Against Reinforcement Learning

Existing backdoor attacks on Reinforcement Learning (RL) typically rely on unrealistic white-box access to victim parameters, rewards, or observations. Inspired by real world behaviors, we introduce the Supply-Chain Backdoor (SCAB) attack to demonstrate that such assumptions are unnecessary. SCAB targets the common practice of training with third-party policies, poisoning the dataset solely through a black-box of legitimate agent-environment interactions. With only 3% data corruption, SCAB demonstrates a peak attack success rate exceeding 90% and reduces victim returns by 80%. These findings expose a critical vulnerability in the modern RL supply chain, highlighting that reliance on untrusted external agents constitutes a severe and practical security risk.

Developers often speed up Artificial Intelligence training by downloading pre-trained AI agents for their systems to practice against. We demonstrate that this common practice carries hidden dangers. Our research introduces the Supply-Chain Backdoor (SCAB) attack, proving attackers can implant hidden vulnerabilities into an AI without hacking its internal code. Instead, a malicious downloaded agent secretly manipulates the victim simply by participating in normal interactions and subtly rewarding bad habits. By corrupting just 3% of the training data, the attacker embeds a hidden "backdoor" that can later be activated over 90% of the time, plummeting the victim's performance by 80%. This exposes a critical security risk in modern AI development.