Abstract: In recent years, backdoor attacks on deep reinforcement learning have attracted widespread attention. Among the studies that have been published so far, no universal and interpretable backdoor attack framework has been proposed. To solve this problem, the article proposes a novel backdoor attack technique, which is called edge attack. A backdoor agent is trained through two stages. Especially during the training process, when the environmental observation vector meets the set conditions, triggers are added to the environment and a specially designed reward function is used. The article evaluates the effectiveness of the proposed method on four of the most advanced deep reinforcement learning algorithms. The experimental results show that when the backdoor is hidden, the success rate of the backdoor agent in handling the automatic parking task reaches 93%. However, once the backdoor is activated, the attack success rate reaches 94.3%, while the success rate of the automatic parking task decreases to 5.7%.

Key words: deep reinforcement learning; autonomous driving; backdoor attack; end-to-end

摘要： 近年来针对深度强化学习的后门攻击引起了广泛关注，在目前已发表的研究中没有提 出一种通用的可解释的后门攻击框架。为解决这个问题，文章提出了一种新颖的后门攻击技 术，称为边缘攻击。通过两阶段训练出一个后门智能体，特别在训练过程中，当环境观察向 量满足设定条件时，在环境中添加触发器并使用一个特别设计的奖励函数。文章在四种最先 进的深度强化学习算法上评估所提议方法的有效性。实验结果表明，在后门被隐藏时，后门 智能体处理自动泊车任务时成功率达到 93%，而一旦后门被激活，攻击成功率达到 94.3%， 而自动泊车的任务成功率则降低到 5.7%。

关键词: 深度强化学习；自动驾驶；后门攻击；端到端