Temporal Logic-Based Multi-Vehicle Backdoor Attacks against Offline RL Agents in End-to-end Autonomous Driving
Authors: Xuan Chen
Shiwei Feng
Zikang Xiong
Shengwei An
Yunshu Mao
Lu Yan
Guanhong Tao
Wenbo Guo
Xiangyu Zhang
Venue: NeurIPS 2025 poster ()
Keywords: backdoor attack; autonomous driving security; offline RL
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Assessing the safety of autonomous driving (AD) systems against security threats, particularly backdoor attacks, is a stepping stone for real-world deployment. However, existing works mainly focus on pixel-level triggers which are impractical to deploy in the real world. We address this gap by introducing a novel backdoor attack against the end-to-end AD systems that leverage one or more other vehicles' trajectories as triggers. To generate precise trigger trajectories, we first use temporal logic (TL) specifications to define the behaviors of attacker vehicles. Configurable behavior models are then used to generate these trajectories, which are quantitatively evaluated and iteratively refined based on the TL specifications. We further develop a negative training strategy by incorporating patch trajectories that are similar to triggers but are designated not to activate the backdoor. 
It enhances the stealthiness of the attack and refines the system’s responses to trigger scenarios. 
Through extensive experiments on 5 offline reinforcement learning (RL) driving agents with 6 trigger patterns and target actions combinations, we demonstrate the flexibility and effectiveness of our proposed attack, showing the under-exploration of existing end-to-end AD systems' vulnerabilities to such trajectory-based backdoor attacks.
Videos of our attack are available at: https://sites.google.com/view/tlbackdoor/home.

Temporal Logic-Based Multi- Backdoor Attacks against Offline RL Agents in End-to-end Autonomous Driving
Xuan Chen', Shiwei Feng', Zikang Xiong', Shengwei An', Yunshu Mao', Lu Yan',
Guanhong Tao², Wenbo Guo", Xiangyu Zhang'
Puurdue University
University of Utah
University of California, Santa Barbara
{chen4124, feng292, xiong84, an93, mao128, yan390, xyzhang)@cs. purdue. edu {guanhong tao) @utah. edu edu (henrygwb) @uesb. edu
Abstract
Assessing the safety of autonomous driving (AD) systems against security threats, particularly backdoor attacks, is a stepping stone for real-world deployment. How- ever, existing works mainly focus pixel-level triggers that impractical deploy in the real world. We address this gap by introducing a novel backdoor attack against the end-to-end AD systems that leverage trajectories as triggers. To generate precise trigger trajectories, we first use temporal logic (TL) specifications define the behaviors of attacker vehicles. Configurable behavior models are then used to generate these trajectories, which are quantita- tively evaluated and iteratively refined based on the TL specifications. We further develop a negative training strategy by incorporating patch trajectories that are similar to triggers but are designated not to activate the backdoor. enhances the stealthiness of the attack and refines the system's 's responses trigger scenarios. Through extensive experiments on offline reinforcement learning (RL) driving agents with 6 trigger patterns and target actions combinations, we demonstrate the flexibility and effectiveness of our proposed attack, showing the under-exploration of existing end-to-end AD systems" vulnerabilities to such trajectory-baie -based back- door attacks. Videos of our attack are available at: t1laackdorr
more other vehicles'
Introduction
demonstrate promising performance in diverse applications [16] (84), their robustness and re reliab bibliiyyyyyoo against a wide range of security threats become one of their crucial capabilities [73]
As end-to-end autonomous driving systems 36
20
53 27]. Exploring and understanding
the vulnerability of the AD systems in simulation against backdoor attacks is stepping stone for mainly rely on patch triggers, where an adversary directly stamps fixed patch onto the ego car's camera-captured frames. While it is possible to design physically realizable pixel-level adversarial patterns (23), these attacks face several practical limitations when applied to real-world AD systems. First, attackers typically cannot directly modify the internal camera input of the ego vehicle, any visual perturbation must be introduced through physical means (e.g., printed patches objects placed in the environment), which significantly constrains what is feasible. Second, these visual triggers are often highly sensitive to viewpoint, distance, and lighting conditions; thus, what appears adversarial from perspective may become ineffective or unrecognizable from another due to changes in the ego car's pose or motion. These
real-world deployment. Existing works 30
3
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

A ttacker drive along trigger trajectories, bypass the ego car simultaneously.
Poisoned ego takes the target action, suddeoly turning left without braking.
Daring testing
Pgo
A Altacker tar
Ofber car
Figure 1: An example of our proposed backdoor attack.
challenges limit the robustmess and consistency of pixel-level attacks in complex, real- world driving scenarios.
To address the limitations of pixel-level triggers, we propose backdoor attack with triggers that more practical and adaptable to deploy in the physical world. Our trigger is defined as the trajectories of one or more conttler-contoolled vehicles. By driving along specific trajectories. these vehicles alter their positions, which can be detected by the poisoned ego car's sensor and LiDAR, thereby activating the backdoor and causing unsafe behavior. Figure illlustrates an example of our attack. Two attacker vehicles simultaneously bypass the ego car, moving from behind to ahead of it. The entire process is observed by the ego car, which has been poisoned by the attacker. As a result, the ego car executes the target action of suddenly turning left, leading to a dangerous outcome.
There two key components achieve our proposed attack. First, manually specifying the trigger trajectory with precise spatiotemporal coordination for multiple attacking vehicles is time-consuming and unrealistic. To address this, we propose novel TL-bbased framework that automatically generate sophisticated trajectories of different vehicles. Second, simply poisoning the ego car with trigger trajectories largely introduces false positives. To mitigate this, we develop negative training strategy that generates patch trajectories, which are similar yet distinct from the original triggers, to train the agent behave normally under non-trigger scenarios. As detailed in Section 3] our TL framework seamlessly integrates the poisoning process with negative training to avoid false activation of the target behavior.
Unlike methods that focus on adversarial scenarios generation and perturb the environment at inference time to stress-test pre-trained driving models [8] 89, our method targets training phase and poisons the data so that a dormant back door is embedded and triggered later by a coordinated, multi-vehicle trajectory pattern. To the best of our knowledge, this is the first work demonstrating the practicality of trajectory-basee backdoor attacks against end-to-end AD systems. By leveraging temporal logic-based framework, between multiple attack vehicles and iteratively refine these trigger trajectories. We further use negative training to ensure that the backdoor in the poisoned models activates only when the exact trigger trajectories are present. We conduct extensive evaluations on five offline RL agents using practical trigger designs, demonstrating the effectiveness and feasibility of our attack. We also examine the capability of existing defenses against our attack.
automatically generate trajectories with complex interactions
Our approach shifts the focus from direct manipulation of the target vehicle input (e.g., camera images) to exploiting the vehicle's contextual awareness algorithms. Complex multi-vehicle trajectories have rarely been considered in backdoor attacks, despite their plausibility in realistic scenarios. We are the first work to establish the feasibility of trajectory-based backdoor attacks, revealing an under-explored yet critical vulnerability to AD systems.
2 Related work
Backdoor attacks in AD systems. Backdoor attacks have been extensively studied in computer vision and natural language processing domains [49
14
66
15
45
For AD systems, these attacks
91 focus on physical backdoor attacks against deep neural network (DNN)-based lane detection (LD) systems. The triggers are static patterns stamped on the image-based input of the DNN model within the LDD module to induce the wrong prediction of the lane points. [56) introduces adversarial trajectories as triggers to poison training data, which leads to a misprediction of the future trajectory when the attacker's 's car drives
specifically target different individual modules 66 92..
33

---

along a specific way. Some works select vision language the target model, and consider specific physical objects (e.g.. ballon) on the image as the trigger and associate it with dangerous instructions to the downstream AD systems to perform poisoning attacks. Beyond backdoor attacks,
AD systems 22 32 [3] as
[S] 6, [9] enhance the adversarial robustness by generating adversarial trajectories that can lead to misprediction during inference, without training data poisoning.
Application of TL in AD security. Temporal logie [22] serves as a critical tool in the security testing of AD systems by providing formal method to define and verify safety and security properties under diverse operational scenarios. Existing works mainly focus on generating complex scenarios with the help of TL-based language to automatically search for specification-vin -violatin test cases in AD systems [2] 70 93 [8]. In particular, (64] employs TL to specify safe missions for the ego car and use fuzzing techniques to generate adversarial trajectories of other cars, which will intentionally lead the ego car to violate safe missions. Their TL. specifications primarily describe the behavior of the ego car, focusing on its adversarial robustness. In contrast, our approach uses TL to evaluate the trajectories of multiple surrounding vehicles, which act as triggers in the backdoor attack.
DRL in AD and its vulnerability to poisoning. Deep reinforcement learning (DRL) has been increasingly applied AD to enhance decision-making processes under uncertain and dynamic driving conditions, particularly within end-to-end driving systems [T3 39 68]
19, 7 38
Despite
its advancements, DRL has been shown to be susceptible to various security threats (55
29
40 75
88 []] Notably, [0) show that offline RL is vulnerable to data poisoning during training and
conduct experiments on AD tasks with static patch triggers. There no existing work studying
the vulnerability of RL to backdoor attacks when it is applied to end-to-end driving systems with multi-vehicle-involeed trajectory triggers that are realistic to deploy in the real world.
There are backdoor attacks targeting single-agent DRL [40] 177, where they add a small perturbation patch to the victim agent's 's state as the trigger. A follow-up work considers two-agent setup with an adversarial agent and a victim agent (75). Rather than perturbing the states,
RL backdoor:
they leverage the adversarial agent's certain actions the backdoor trigger. More recent works generalize both perturbation- based attacks and adversarial agent attacks to multi-agent cooperative RL with team of victim agents [12]. Beyond backdoor injection, several studies explore enhancing the robustness and understanding of RL under ad adversarial or security-sensitive settings. B g
propose a generalizable framework for detecting and removing backdoors from deep RL agents. Similarly, [86) introduce an interpretability-drivee method for detecting poisoned samples in NLP models. EffiTune (25 further studies training inefficiency in robot navigation, underscoring the role of data efficiency in robust autonomous systems. These insights are complementary to RL security research, suggesting that semantic-level reasoning could play a vital role in detecting subtle trigger manipulations in sequential Decision-making tasks. Moreover, the intersection of large language
models (LLMs) and RL has led to new attack paradigms 9 35
10
76
85 27
3 Methodology
3.1
Preliminary
Problem formulation. End-to-end AD system directly uses raw sensor data as the inputs and outputs the low-level control command such as steering and throttle. We focus on RL-based driving policy in this paper. Within our scope, the driving task can be formulated as a Markov Decision Process (MDP) defined as M = A, r. μ., p). S denotes the state space, A denotes the action space, denotes the reward function, μ E (SS) denotes the initial state distribution, y E [0, 1] is the discount factor, and p: S x A- - (SS) is the transition dynamics, where ( denotes the set of probability distributions over a set X. Our goal is to find policy π S A(A) (or π S - A if deterministic) that maximizes the discounted total reward:
S x A + R
T Σ ' (ct) an) 1==
max ( (TT (7)
where (T) D" (So, Go, $1, 01 .,, 8T, aT) (so) x (ao so) I |so ao) x (ar ST). solely coming from a static dataset D = (T)),e(1......1
Threat model. We follow the threat model in existing works 33 30 78 assuming that the attacker
has access to the offline training dataset D of the driving agent. It simulates realistic setting where
3

---

AD developers might rely on potentially malicious third parrt annotation services to annotate their data. The attacker can inject a specific trigger into the training trajectories and manipulate the victim agent's reward. After downloading the poisoned dataset, RI. developers train agents that will be embedded with backdoors. We assume the adversary has no knowledge about the victim's training algorithm, the MDP, or control over the training process.
Moreover, assuming the attacker originates from an external annotation provider is consistent with real-world data collection practices in AD. Leveraging third-party annotation services (e.g., Scale AI, Amazon Mechanical Turk, etc.) is a well-established and widely adopted practice in the AD field: for example, leading datasets such as nuScenes 4 and PandaSet [79] explicitly credit Scale AI for labeling trajectory data, while BDD100K [87 leverages Amazon Mechanical Turk. Both academic surveys and empirical industry studies document an entire ecosystem of external annotation vendors that AD companies routinely rely on 48). Therefore, modeling the attacker as an adversarial annotator with access to the full training dataset, but without access to the victim's 's training algorithm or control of the training process, aligns closely with practical deployment scenarios and the threat assumptions stated above.
When launching the attack, the attacker controls surrounding vehicles to follow trigger trajectories, causing the poisoned RL driving agent to execute dangerous target behaviors. Importantly, the attacker aims to keep their own vehicles safe and inconspicuous, without collisions or obviously aggressive behavior, so the triggering scenario remains realistic. Once the backdoor trigger pattern is observed, the poisoned ego car executes a predefined unsafe action. Different from prior works [90] [ [] they focus on the trajectory prediction module within the AD system, and the attack goal is the mispredictions of other vehicles' future positions. In contrast, our work targets the end-to-end AD system that can directly cause the ego car to perform dangerous maneuvers.
3.2 Overview
As illustrated in Figure 2 our attack consists of two phases. In the trigger trajectory generation phase, we use TL specifications to precisely define and verify the behaviors under which the attacker vehicles must behave, ensuring that the generated trigger trajectories meet realistic constraints while still achieving the attacker's intention. Then we rely on configurable behavior models to generate natural and complex trajectories, which will be quantitatively evaluated and iteratively refined with the help of TL specifications. In the training phase, those trajectories are added to the training set of the RL driving agent to poison it. In the following sections, we present our design rationale and technical details.
Temporal logic-based trigger generation. Manually specifying the positions of each attacker vehicle to generate trigger trajectories is time-consuming and unrealistic. To automate this process, common approach is to directly solve the trajectories by adding context-related constraints to an objective function [67] 18. These methods then use advanced solvers ① and the vehicle dynamics model (58) to solve ordinary differential equations, which finally yield vehicle positions at every second. However, the main limitation is that this approach heavily relies on precise dynamics models to solve natural-looking trajectories, which can be costly and time-consuming obtain.
Given this challenge, instead of directly solving the trigger trajectories, as shown in Figure 2 we divide it into two steps: behavior model-driven trajectory generation and temporal logic- based trajectory evaluation. First, we deploy multiple attacker vehicles that are equipped with different behavior models to generate realistic and natural trajectories. Intuitively, the behavior model defines control schemes that govern the vehicle actions and ensure they act in predictable, rule-based manners, such lane following, and overtaking the ego car when conditions permit. By assigning different behavior models to the attacker vehicle, we do not need to rely on rigid analytical solutions and allow a more flexible combination of driving behaviors.
Formally, let V {wi, o2,..., }m be the set of m attacker vehicles, each vehicle v. follows a behavior model B, Here B, is defined as (s 0,) + a, where is the state of the vehicle (c.g.. current position, speed, lane information), O, = [<x;" (0) w/ (0)) ), (0) is a vector of configurations, including initial positions (x:()),
,3; .y)")) and speed 14, and is the resulting control signals, i.e., throttle and steering determined by B, During simulation over a time horizon T, each vehicle v; produces a
{xx 0i 000 < <<T) T) where (2 (2) represents the position of vehicle v, at
(0)
trajectory 7.

---

1. Temporal logio-based trigger trajectory generation
1.1. Bebavior model driven trajectory generation
1.2. Temporal logic-based trajectory evaluation
behavior models
deploy
collect trajectory
evaluate
numerical score
speed
initial position
temporal logic specification &
x
II. Trigger Insertion & training optimization
poisoned Inajectory
tasting
training
without Ingger
clean trajectory
patch trajectory
with tigger
Figure 2: Overview of our attack. Phase I: the attacker selects behavior model, specifies the speeds and initial positions, and deploys to collect trajectories. These trajectories are then evaluated with TL specification, yielding positive or negative score that indicates whether the attacker's goal is met. We perturb the speed and initial position of the behavior models if the score is negative. Phase qualified trajectories and patch trajectories are added to the training set to train the RL driving agent. During testing, the ego car will behave normally execute targeted actions when the trigger is present.
time t. Note that besides multiple vehicles' trajectories, our framework can be casily extended to single vehicle cases, while we use multi-ehiicle as an example.
TL serves as an ideal framework for evaluating whether continuous signals satisfy predefined posi- tional constraints specific time steps. In the second step. we define TL specifications for different trigger trajectory patterns separately, which we will provide more details in Section 3.3 Intuitively, these specifications are designed to capture whether the trajectories meet certain conditions that define the trigger. Let Φ; represent the TL expression for the i-th vehicle, to handle graded satisfaction, i.e., how closely т; satisfy di, we define a score function E(T,, di) E R where higher scores indicate that the trajectories more precisely fulfill the desired specification. A positive score (TT,, )b) >> O implies d; satisfied, while negative or zero scores indicate non-satise con-satisfaction If ((T; Φx) S 0 we will randomly perturb the configurations O, of these behavior models to explore alternative trajectories Tf and re-evaluate (T( Φ). This process continues until a positive score is achieved, indicating that the desired trigger trajectory has been found.
Trigger insertion. To construct a complete poisoned dataset D', we collect the agent's state by deploying the attacker vehicle and obtaining the corresponding ego car state. Additionally, we modify the ego car's action from a, to o/, i.e., the target action of the ego car after it observes the trigger trajectory, and we manipulate the reward from Y, to r'y
During the poisoning process, make key observation that the target action be falsely activated by similar but non-trigger behaviors. Using the two cars simultancously bypassing an example, the poisoned agent that has been trained on such kind of trigger will take the target action when there is only one car bypass. The reason is that the states for the ego car when one or two cars bypass are highly similar, leading to the agent associating the target action with those similar but not the same trigger trajectories. Thus we introduce the negative training strategy. Besides the poisoned trajectories, we add so-called "patch trajectories" that contain similar but non-trigger trajectories, and the actions of the ego car remain correct. These patch trajectories can be easily obtained by collecting those trajectories whose TL scores are negative and smaller than a preset threshold, i.e., E(T, Φ) < X. It enables to train the attack model so that the backdoor can only be activated under trigger conditions, thus helping attackers to deploy more stealthy attacks by filtering out the falsely activated trigger scenarios. As will demonstrate in Section 4.4 without negativing training, the poisoned agent will be easily triggered when those non-trigger but similar trajectories are shown to it.
3.3 Technical details
Behavior models. The behavior model B 669 has rule-based framework that generates control signals a to help the vehicle v; E V adjust its speed and maintain longitudinal safe distances from other vehicles. For instance, steering behaviors are influenced by parameters such as the maximum
5

---

steering angle and PID control settings, which help to achieve precise lane following and maneuvering. Building upon the basic lane-following capability of the behavior model, we customize and extend this model into two specialized behaviors: overtaking and braking. The overtake variant augments the basic model by incorporating rules that allow vehicle to safely change lanes and overtake another vehicle when some longitudinal distance conditions are met, such as sufficient gaps in the adjacent lane and the vehicle. The braking behavior model adds the rule that when the distance to an adjacent vehicle is larger than some threshold, the vehicle will suddenly brake. By integrating these customized behaviors into the behavior model, we enable a complex set of interactions between multiple vehicles, which simplifies our trigger generation.
Temporal logic specification. Specifically, we define a signal temporal logic-based framework that supports three core predicates. Let Freach (t, R) be an atomic proposition indicating whether the i-th vehicle's position at time / lies within the region R (e.g., rectangle), F denotes "evventuall"" operator and G denotes "always" operator. Using this notation, we further define the following predicates:
Reach (R, [ts, tel) == F(ts, tee Meeach (t, R), which requires the vehicle i must enter region R within the time window [tx: fe).
Avoid(R, [ts, tz]) :- tel (t, R), which requires the vehicle i not to enter the region R within the time window [ts, fe).
St,y(R, [t., (e]) :- Git,, de] (4, R), which ensures that the vehicle i remains continu- ously within the region R throughout the time window [ts, [e].
These predicates can be combined with logical operators (e.g., A, V, -) and temporal operators (e.g.. F, G, U) to define more complex and coordinated multi-vehicle specifications. For example, to describe two attacker vehicles synchronously bypassing the ego car, we combine each involved vehicle's ' TL expression dy as o- := A 6; A (F(t,, fj] (f)a Tools like STLpy [4]] and DiffSpec [80] can be used obtain quantitative scores of (TT,, ot), guiding iterative perturbations of the vehicles' behavior models until these spatial and temporal constraints are robustly satisfied. The complete algorithm in Appendix D
4 Evaluation
4.1
Experiment setup
Simulator & RL agent. We conduct experiments on MetaDrive [44, a self-driving simulator that mimics intricate real-world driving situations. The goal of the end-to-end driving agent is to arrive the destination from the starting point without any crash. There three tasks with increasing difficulty: easy, medium, and hard. Harder maps include complex scenarios like crossroads and roundabouts. The agent's state is represented as a vector that includes the ego vehicle's 's heading, velocity, and LiDAR- based information about the surrounding environment. In MetaDrive, the ego agent does not process raw sensor data like LiDAR point clouds; instead, it receives these high-level, simulator-providee features as input to its driving policy. The action is steering and throttle and the reward functions include dense rewards (Iongitudinal progress) and sparse terminal rewards (for completing or failing the task). We set X 15 when generating the patch trajectory. More experiment details are included in Appendix C
Metrics. We employ three widely used metrics to evaluate the performance of the driving agents: cumulative reward, average displacement error (ADE), and mission violation rate (MVR). The cumu-
lative reward for a trajectory 7 is defined as: R(T) = Σ rt. ADE measures the root mean squared
error between the predicted and ground-truth trajectory: ADE + V(a, )2 + (ūr yz)². It is widely used to measure the performance of trajectory prediction modules 190] 36]. We adapt ADE to compare the trajectory of the evaluated agent with that of clean agent, measuring deviations caused by triggers. The ego car's mission is to safely reach its destination. For each episode, we record whether the mission is finished episodes in which the ego car fails to complete its mission. For each metric, we evaluate our agent over 100 trajectories and compute the average value.
boolean value and calculate the MVR as the ratio of
Trigger & Target action. We design three distinet trigger trajectory patterns: 1) two cars syn- chronously bypass the ego car, 2) one car bypasses from one side while another overtakes, and 3) one

---

Table 1: Attack effectiveness of three trigger patterns tasks with different difficulty levels. The original column shows performance a clean agent without any attack. The benign column shows the performance of a poisoned agent when there no trigger. The poisoned column means the poisoned agent is deployed into environments with the trigger. All results are averaged over 100 trajectories.
Reward
ADE
MVR
Trigger polliem
Original
Benign
Paisoned
Original
Benign
Possoned
Original
Benign
Poisoned 1
Sync-bypass Overtake
368.25
107.14
1.00
Easy
388.06
359.65
15.39
0.31
1.59
103.02
0.90
0.00
1,00
Bakk-overtake
385.25
130.98
0.92
76.05
0.00
0.90
Sync bypass
309.67
42.58
0.93
83,32
0.15
1,00
Medium
319.06
Brake overtake
303.37
69.26
1.41
74.57
0.34
0.73
Syne-hypass Overtake
268.14
82.46
1.63
65.72
0.33
1,00
Hand
267.39
254,82
45.82
0.37
62.43
0.18
1.000
Brake-ovatake
246.31
76.12
1.65
42.82
0.21
0.56
T=10
T=50
T=60
(a) Benign agent behaves normally when two vehicles bypass
T=10
T=50
T=60
(bb Poisoned agent suddenly tums left when two vehicles bypass
Figure 3: Closed-lop evaluation.
suddenly brakes in front of the ego the left while the other overtakes. The complexity of the trigger patterns increases as the coordination and timing between vehicles become more intricate. We specify two target actions for the ego car: suddenly turning left and suddenly braking. It will be triggered when the ego car's distance to another vehicle exceeds 10 meters. In Appendix E. we conduct experiments discussing the stealthiness of our designed triggers using real-world driving trajectories NGSIM ?1 Appendix D.3 discusses the practicality of avoiding the trigger during deployment.
4.2 Attack effectiveness
Different trigger patterns. We evaluate the effectiveness of three trigger patterns on three tasks and report the results in [able We use Coptidice [43] the RL algorithm
shown perform the best on MetaDrive tasks in [50], which can better reflect the influence of different trigger designs. We set the same poisoning rate of 10% for all trigger patterns, consistent with existing works [30] and the number of patch trajectories is the same as the poisoned trajectories. We study the effect of poisoning rate on attack effectiveness in Section 4.4 The results of single-vehicle trajectory as the trigger are in Appendix E Our focus is primarily on multi-vehicle trajectories, they are more stealthy and challenging to inject.
The results demonstrate that our attack is effective across all trigger patterns and task difficulties. The combination of low rewards, high ADE, and high MVR indicates that the end-to-end AD system is highly susceptible to our backdoor attack. We also find that complex triggers are more challenging inject. For example, the brake-overtake trigger requires more intricate coordination between two attacker vehicles, leading to lower overall attack effectiveness compared to the other two triggers, under the same poisoning rate. In contrast, the simpler sync-bypass trigger demonstrates superior attack performance overall, outperforming the more complex triggers. In the benign setup, the backdoored agent achieves higher MVR in medium and hard tasks compared to easy ones. This suggests that the backdoor attack has more pronounced effect on the agent's clean performance in challenging environments. This may be because the agent's capacity to handle complex tasks already strained, and the backdoor further disrupts its behavior.
7

---

Table 2: Attack effectiveness different offline RL algorithms.
Reward
ADE
MVR
Task
Algorithm
Original
Benign
Poisoned |
Original
Benign
Poisoned
Original
Benign
Poisoned
BC
210.52
95.34
49.73
2.66
1.56
98.85
0.21
0.33
0.90
Easy
BCQ
391.32
391.27
132.49
0.26
1.15
84.88
0.00
0.00
0.69
Coptidice
388.06
368.25
8.23
0.31
0.92
76.05
0.00
0.00
1.00
BC
180,30 30
183,59
34.77
0.72
2.14
70.21
0:42
0:45
0.71
Medium
256.79
0.22
Coptidice
319.06
309.67
42.58
0.28
0,93
83.32
0.23
0.15
1.00
BC
207.56
218.56
193.22
2.82
1.73
20.14
0.25
0.35
0.31
Hard
BCQ
241.24
230.15
0.23
1.34
58.63
0.00
0.37
0,78
Coptidice
267.39
264.94
50.65
0.37
1.42
61.96
0.18
0.35
1.00
Table 3: Attack performance comparison of two target action designs.
Turn Left
Suddenly Brake
Task
Trigger pattem
Clean reward
P-Reward
P-ADE 1
P-MVR
P-Reward
P-ADE 1
P-MVR
Sync-bypuss
7.01
106.78
1.00
34.98
90.92
1.00
Easy
Overtake
388.06
15.39
103.02
1,00
40.25
83.17
0.85
Brake-overtake
130.98
76.05
0,90
45.17
97.22
0.81
Sync-bypass
50.65
61.96
1.00
55.48
61.43
1.00
Medium
Overtake
267.39
45.82
62,43
1,00
75.41
48.18
0.76
69.26
74.57
0.73
80.15
73.46
0.77
Sync-bypass
42.58
83.32
1,00
66.06
89.13
1.00
Hard
Overtake
319.06
38.39
80.31
0.89
73.89
64.87
0.70
Brake-overtan
76.12
42.82
0.56
80.02
62.17
0.53
Different RL algorithms. We focus offline RL as it allows for straightforward dataset poisoning, offering more control over the attack process. The effects of poisoning are equivalent offline and online RI, as both involve training poisoned data. Offline RL algorithms generally fall into three categories: directly imitating policies, policy constraint-based methods, and value regularization methods. We select one representative algorithm from each category and apply our attack on the three algorithms BC [59], BCQ (28) and Coptidice [43 The results are summarized in Table 2
Our backdoor attack is successfully executed in all three RL algorithms. Specifically, observe significant drop in poisoned rewards, with averages declining from over 200 to below 60, while ADEs surged from under 1.0 to over 50, and poisoned MVRs increased from 0.0% nearly 100%. These metrics demonstrate the effectiveness of the backdoor attack in compromising different RL agents' performance. The BC agent's performance, even under benign conditions, is notably poor across all three difficulty levels and inferior to that of the other two algorithms. Moreover, the poisoned MVR for the BC agent is not as high as that of the other two algorithms, suggesting that the attack is less effective on this algorithm. This may indicate that BC inherently lacks robustness, or it may be less susceptible specific types of adversarial manipulations used in our attacks. We further discuss the effectiveness of the proposed attack on agents trained with safe RL algorithms in Appendix
Different target actions. In addition to the sudden left turn, introduce sudden braking another target action to further assess our attack's practicality. As shown in Table 3 both target actions are effective, highlighting the flexibility of our attack to align with the attacker's intent and showcasing its generalizability. Since turning left is more complex to execute than braking, this leads to two key observations: (1) the left turn results in higher MVR, it involves simultaneous steering and throttle adjustments, making it more challenging to achieve than sudden braking. (2) turning left also causes higher P-ADE, as it disrupts the agent's behavior more severely than braking. Consistent with Table I across tasks of varying difficulty, the sync-bypass trigger pattern yields the best overall attack performance for both target actions, suggesting that the simplicity of the trigger contributes to its superior effectiveness. Figure shows an example of our closed-loop evaluation.
Different weather conditions and velocity. We leave the results of different weather conditions and velocity effect on the attack effectiveness in Appendix E.7 and E.3
4.3 Defense and mitigation
Defense selection. Traditional backdoor defenses 72
62
37 mainly focus on static
triggers and cannot be directly applied in attack, where the trigger set of dynamic vehicle
8

---

Table 4: Poisoned reward and MVR comparison with Table 5: Ablation study of the negative training design (w.) and without (wo) applying two defenses. Higher in our attack. Clean reward denotes reward the poisoned reward and lower poisoned MVR indicate bet- poisoned agent when there is no trigger in the environ- ter defense performance.
ment.
Tink
Teigtt arree
Proveed sovurt
Siceediing
LPPPSGD
Proveed
S.Sncedeng
V.. D.PP-GD
Triger patter
FAVEE
Now-tigge
W: migg
900 s2g
Resign
Bay
Beale
14.88
112.4
16.15
1.0
0.31
1/91
Eas
Dvatiaio
2.89
100
0..41
12.39
1.61
555.76
166 11
360.23
172.55
355.65
117.24
Madeen
Tuen
Brike
53.05
33.46
196.35
77.12
90.7
$1.39
1.80
1.80
0.34
1.50
1.91
1.00
MAlken
Ovettaio
loyee
0.82
100
0.13
43.31
49:55
257.33
253.53
201.86
254.04
254.82
Bad
Tur
Brake
09.96
42.98
36637
59.21
07.37
1.89
1.00
1,09
100
1/0
Had
Sync
0.74
0:10
78563
799 06
739.87
trajectories. Similarly, backdoor defenses designed for RL agents 3 3 31 are also not inapplicable, as they also consider static patch triggers. Considering that our proposed attack is based on data poisoning and remains agnostic to the training algorithm, following existing work [56], we assume the defender has access to the training process of the poisoned agent. Thus we can deploy the defense during training to detect poisoned samples. Specifically. we consider two training- time defenses. The first is trajectory smoothing [90]. a pre-processing technique to mitigate adversarial attacks against the trajectory prediction module. It serves as a data-level defense, smoothing out the trajectories to prevent adversarial patterns from inftuencing the training data. The second is DP-SGD (34, which targets the training algorithm itself. It clips the gradients of the weights with abnormal l2 norm and adds Gaussian noise mitigate the effect of poisoned samples. Implementation details are included in Appendix D
We explored using BadRL 17
to minimize the poisoning rate in Appendix E.6
Our findings in Table 4 highlight the limitations of current defenses against our proposed attack. Smoothing defense shows some effectiveness in mitigating backdoor attacks, particularly when the target action is sudden braking. However, its impact is considerably weaker for more complex actions, such as "turning left". This is likely because turning requires more intricate coordination of both speed and steering, which the smoothing defense may not sufficiently handle. For DP-SGD defense, we observe no meaningful prevention of crashes, as evidenced by the persistent P-MVR of 1.00. While there a slight improvement in reward, allowing the agent to progress further toward its destination, it ultimately still fails by turning left and colliding with the roadside. This ineffectiveness can be attributed the fact that the data poisoning in our proposed attack does not introduce significant abnormal gradients, making DP-SGD less effective in mitigating the attack. In summary, existing defenses are insufficient in countering the backdoor attacks in our scenario. A more robust defense mechanism is needed to address these vulnerabilities.
Results.
4.4 Ablation study
Poisoning rate. To evaluate the impact of poisoning rates on the effectiveness of our proposed attack, we use different poisoning rates, i.e., 10%, 20%, 30,, and 40% to generate the poisoned dataset and train the poisoned agent on a hard-level task with two different RL algorithms. We select two vehicles bypass simultancously as the trigger, and the target action is suddenly turning left. The results are shown in Figure 4a| and Figure 4b We first observe that with the increase in the poisoning rate, the benign reward of the poisoned agent decreases, indicating that the normal functionality of the agent has been impacted, and it also makes the poisoned agent easy to detect. A higher poisoning rate leads to an increase in the poisoned MVR, which is expected since the agent is trained with more poisoned trajectories, reinforcing its recognition of the trigger pattern. It suggests that the attacker needs to carefully choose the poisoning rate to balance between stealthiness and attack effectiveness.
Negative training. To validate the necessity of negative training, we remove this step and train the poisoned agent without patch trajectories. This variation is denoted as w/o neg. As discussed in Section 3.3 patch trajectories are those with TL evaluation score below threshold. Instead of using them as the patch trajectories, we record the configurations of those attack vehicles that generate the patch trajectories. During testing, we deploy these attack vehicles to reproduce the scenarios in which similar but non-trigger trajectories appear and we measure the MVR and cumulative reward, which are referred to as F-MVR and non-trigger reward. A clean pattern in Table i is that without the negative training, the MVR for non-trigger trajectories is significantly high, even reaching 100%, while the non-trigger reward is low. It indicates that the agent performs the target action even without the trigger. These observations suggest that without negative training, the poisoned agent is easily misled by non-trigger trajectories, highlighting the critical role of negative training in filtering out corner
9

---

(a) PR VS. BR.
(b) PR vS. P-MVR.
(c) # of AV vs. BR.
(d) # of AV vs. P-MVR.
Figure 4: Ablation study results. The first two figures show how different poisoning rates affect the benign reward and MVR when the trigger appears (P- (P.MVR). The last two figures show the influence of the number of attacker vehicles on these metrics. Results compare two offline RL. algorithms, with blue and red dashed lines indicating the clean agent's rewards for each. PR refers to "poisoning rate" and BR refers to "henign reward".
cases to enhance the attack's stealthiness and precision. Moreover, we observe that the inclusion of patch trajectories does not degrade the benign performance of the poisoned agent. The results of other metrics are shown in Appendix E
Number of attack vehicles (AV). Figure 4c shows that benign rewards remain stable regardless
of the number of AVs, indicating that additional AVs in triggers do not significantly degrade the agent's performance under benign conditions. This stability suggests that our attack is stealthy, as does not raise suspicion by negatively affecting the benign performance, making it harder detect during normal operation. On the other hand, Figure [4 reveals a decline in P-MVR as the number of AVs increases, under the same poisoning rate. This is because larger number of attack vehicles introduces more variability and complexity, requiring a higher poisoning rate to achieve a consistent attack effect. Overall, while the benign reward remains almost unaffected by the number of attack vehicles, a higher poisoning rate is required to inject more complex trigger patterns.
Dynamics model & Threshold of TL score. We vary the attacker vehicle's 's dynamics model to examine its impact attack effectiivness. We also conduct sensitivity tests on the threshold of the TL score Ả used during our negative training. Due to space limits, details are in Appendix
Conclusion and Future Works
We introduce realistic trajectory-based backdoor attack against end-to-end AD systems. Through strategic manipulation of vehicle behaviors via TL, we automatically generate trigger trajectories and demonstrate the feasibility of generating and deploying dynamic triggers, revealing new vulnerabilities in AD systems. Our negative training strategy further improves the stealthiness and precision of the attack. Through extensive empirical experiments, show the robustness and adaptability of proposed attack using various RI. algorithms and trigger and target action designs. Our experiments against existing defenses and detailed ablation study validate our key design choices.
This work points to a few promising future directions. First, our current TL specification is based on one atomic proposition that evaluates whether the vehicle arrives in some region at specific time. We aim to design more diverse specifications 22 93 that can define more complex behaviors between vehicles. Second, consider RL-based driving agents to be the instantiation of end-to-end AD systems. Existing works explore module- based planning oriented AD systems [36] to achieve full-stack driving tasks. We leave it our future work to extend our attack on such kinds of systems. Third, large language models (LLM) provide the possibility to generate safety-critical scenarios that help AD testing [74]. Inspired by this line of work, will explore how to combine with LLM to generate both scenarios and trajectories to comprehensively test AD systems.
planning-oriented
Acknowledgement
We are grateful to the Center for AI Safety for providing computational resources. This work was funded in part by the National Science Foundation (NSF) Awards SHF-1901242 1HF-1900300, Proto-OKN 2333736, (IS-2416835, DARPA VSPELLS HR001 10S00558 ONR N00014-23-1-2811 and Amazon. Any opinions, findings and conclusions or recommendations expressed this material those of the authors and do not necessarily reflect the views of the sponsors.
10

---

References
[1] Joel AE Andersson, Joris Gillis, Greg Horn, James B Rawlings, and Moritz Dichl. Casadi: a software framework for nonlinear optimization and optimal control. Mathematical Programming Computation, 2019.
[2] Nikos Arechiga. Specifying safety of autonomous vehicles in signal temporal logic. In IEEE Intelligent Vehicles Symposium (IV), 2019.
[3] Shubham Bharti, Xuezhou Zhang, Adish Singla, and Jerry Zhu. Provable defense against backdoor policies in reinforcement learning. NeurlPS, 2022.
[4] Holger Caesar, Varun Bankiti, Alex H. Lang, Sourabh Vora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Giancarlo Baldan, and Oscar Beijbom. nuscenes: A multimodal dataset for autonomous driving. In CVPR, 2020.
[5] Yulong Cao, Chaowei Xiao, Anima Anandkumar, Danfei Xu, and Marco Pavone. Advdo: Realistic adversarial attacks for trajectory prediction. In ECCV, 2022.
[6] Yulong Cao, Danfei Xu, Xinshuo Weng, Zhuoqing Mao, Anima Anandkumar, Chaowei Xiao, and Marco Pavone. Robust trajectory prediction against adversarial attacks. In CoRI,, 2023.
[7] Raphael Chekroun, Marin Toromanoff, Sascha Hornauer, and Fabien Moutarde. Gri: General reinforced imitation and its application to vision-baa based autonomous driving. Robotics, 2023.
[8] Xuan Chen, Wenbo Guo, Guanhong Tao, Xiangyu Zhang, and Dawn Song. Bird: generalizable backdoor detection and removal for deep reinforcement learning. NeurlPS, 2023.
[9] Xuan Chen, Yuzhou Nie, Wenbo Guo, and Xiangyu Zhang. When Ilm meets drl: Advancing jailbreaking efficiency via drl-guided search. NeurlPS, 2024.
[10] Xuan Chen, Yuzhou Nie, Lu Yan, Yunshu Mao, Wenbo Guo, and Xiangyu Zhang. Rl-jack: Reinforcement saanning-powett black-box jailbreaking attack against llms. arXiv preprint arXivv2406.008755 2024.
[11] Xuan Chen, Guanhong Tao, and Xiangyu Zhang, Dynamics model based adversarial training for competitive reinforcement learning. Multi-Agent Security Workshop, NeurIPS, 2023.
[12] Yanjiao Chen, Zhicong Zheng, and Xueluan Gong. Marnet: Backdoor attacks against coop- erative multi-agent reinforcement learning. IEEE Transactions on Dependable and Secure Computing, 2022.
[13] Yilun Chen, Chiyu Dong, Praveen Palanisamy, Priyantha Mudalige, Katharina Muelling, and John M Dolan. Attention-based hierarchical deep reinforcement learning for lane change behaviors in autonomous driving. In CVPR Workshops, 2019.
[14] Siyuan Cheng, Yingqi Liu, Shiqing Ma, and Xiangyu Zhang. Deep feature space trojan attack of neural networks by controlled detoxification. In Proceedings of the AAAI Conference Artificial Intelligence, 2021.
[15] Sheng-Yee Yen Chou, Pin-Ya Yu Chen, and Tsung-Yi Yi Ho. How to backdoor diffusion models? In CVPR, 2023.
[16] Daniel Coelho and Miguel Oliveira. A review of end-to-end autonomous driving in urban environments. leee Access, 2022.
[17] Jing Cui, Yufei Han, Yuzhe Ma, Jianbin Jiao, and Junge Zhang. Badrl: Sparse targeted backdoor attack against reinforcement learning. AAAI, 2024.
[18] Rowan Dempster, Mohammad AI-Sharman, Derek Rayside, and William Melek. Real-time unified trajectory planning and optimal control for urban autonomous driving under static and dynamic obstacle constraints. In /CRA, 2023.
[19] Charles Desjardins and Brahim Chaib Cooperative adaptive cruise control: A reinforce- ment learning approach. IEEE Transactions intelligent transportation systems, 1.

---

[20] Wenhao Ding, Chejian Xu. Mansur Arief, Haohong Lin, Bo Li, and Ding Zhao. A survey on safety-critical driving scenario generation- methodological perspective. IEEE Transactions on Intelligent Transportation Systems, 2023.
[21] Xinpeng Ding, Jianhua Han, Hang Xu, Wei Zhang, and Xiaomeng Li. Hilm-d: Towards high-resolution understanding in multimodal large language models for autonomous driving. arXiv preprint arXiv:2309 058., 2023.
[22] Allen Emerson. Temporal and modal logic. In Formal Models and Semantics. Elsevier, 1990.
[23] Ivan Evtimov, Kevin Eykholt, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-worke attacks on deep learning models. In CVPR, 2017.
[24] Xing Fang. Qichao Zhang, Yinfeng Gao, and Dongbin Zhao. Offline reinforcement learning for autonomous driving with real world driving data. In 2022 IEEE Intelligent Transportation Systems Conference (ITSC), 2022.
[25] Shiwei Feng. Xuan Chen, Zhiyuan Cheng, Zikang Xiong, Yifei Gao, Siyuan Cheng, Sayali Kate, and Xiangyu Zhang. Digimon: Diagnosis and mitigation of sampling skew for reinforcement learning based meta-planner in robot navigation. arXiv preprint arXiv:2409. 10832, 2024.
[26] Shiwei Feng, Guanhong Tao, Siyuan Cheng, Guangyu Shen, Xiangzhe Xu, Yinggi Liu, Kaiyuan Zhang, Shiqing Ma, and Xiangyu Zhang. Detecting backdoors in pre-trained encoders. In CVPR, 2023.
[27] Shiwei Feng, Xiangzhe Xu, Xuan Chen, Kaiyuan Zhang, Syed Yusuf Ahmed, Zian Su, Mingwei Zheng, and Xiangyu Zhang. Tai3: Testing agent integrity in interpreting user intent, 2025.
[28] Scott Fujimoto, David Meger, and Doina Precup. Off-policy deep reinforcement learning without exploration. In ICML, 2019.
[29] Adam Gleave, Michael Dennis, Cody Wild, Neel Kant, Sergey Levine, and Stuart Russell. Adversarial policies: Attacking deep reinforcement learning, arXiv preprint 1066
2019.
[30] Chen Gong, Zhou Yang. Yunpeng Bai, Junda He, Jieke Shi, Kecen Li, Arunesh Sinha, Bowen Xu, Xinwen Hou, David Lo, and Tianhao Wang. Baffle: Hiding backdoors in offline reinforcement learning datasets. In 2024 IEEE Symposium on Security and Privacy (SP), 2024.
[31] Junfeng Guo, Ang Li, Lixu Wang, and Cong Liu. Policycleanse: Backdoor detection and mitigation for competitive reinforcement learning. In ICCV, 2023.
[32] Wencheng Han, Dongqian Guo, Cheng-Zhong Xu, and Jianbing Shen. Dme-driver: Integrat- ing human decision logic and 3d scene perception in autonomous driving. arXiv preprint arXiv:2401.0366 2024.
[33] Xingshuo Han, Guowen Xu, Yuan Zhou, Xuehuan Yang, Jiwei Li, and Tianwei Zhang. Physical backdoor attacks to lane detection systems in autonomous driving. In Proceedings of the 30th ACM International Conference on Multimedia, 2022.
[34] Sanghyun Hong, Varun Chandrasekaran, Yiğitcan Kaya, Tudor Dumitraş, and Nicolas Papernot. On the effectiveness of mitigating data poisoning attacks with gradient shaping, arXiv preprint arXiv:2002.1 / 1497, 2020.
[35] Zhang-Wer Wei Hong, Idan Shenfeld, Tsun-Hsuan Wang, Yung-Sung Chuang, Aldo Pareja, James Glass, Akash Srivastava, and Pulkit Agrawal. Curiosity-driven red-teaming for large language models, arXiv preprint arXiv:2402. 19464, 2024.
[36] Yihan Hu, Jiazhi Yang, Li Chen, Keyu Li, Chonghao Sima. Xizhou Zhu, Siqi Chai, Senyao Du, Tianwei Lin, Wenhai Wang, al. Planning-oriente autonomous driving. CVPR, 2023.
[37] Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. arXiv preprint arXhv:2202.03423 2022.
12

---

[38] Shixiong Jiang, Mengyu Liu, and Fanxin Kong. Vulnerability analysis for safe reinforcement learning in eyber-physice systems. In ICCPS, 2024.
[39] Alex Kendall, Jeffrey Hawke, David Janz, Przemyslaw Mazur, Daniele Reda, John- Wornn Allen, Vinh-Dieu Lam, Alex Bewley, and Amar Shah. Learning to drive in day. In ICRA, 2019.
[40] Panagiota Kiourti, Kacper Wardega, Susmit Jha, and Wenchao Li. Trojdrl: evaluation of backdoor attacks on deep reinforcement learning. DAC, 2020.
[41] Vince Kurtz and Hai Lin. fixed-integer programming for signal temporal logic with fewer binary variables. IEEE Control Systems Letters, 2022.
[42] Dongsu Lee, Chanin Eom, and Minhae Kwon. Ad4rl: Autonomous driving benchmarks for offline reinforcement learning with value-based dataset. ICRA, 2024.
[43] Jongmin Lee. Cosmin Paduraru, Daniel Mankowitz, Nicolas Heess, Doina Precup, Kee-Eung Kim, and Arthur Guez. COptiDICE: Offline constrained reinforcement learning via stationary distribution correction estimation. ICLR, 2022.
[44] Quanyi Li, Zhenghao Peng, Lan Feng. Qihang Zhang, Zhenghai Xue, and Bolei Zhou. Metadrive: Composing diverse driving scenarios for generalizable reinforcement learning. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
[45] Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In CVPR, 2021.
[46] Zenan Li, Fan Nie, Qiao Sun, Fang Da, and Hang Zhao. Boosting offline reinforcement learning for autonomous driving with hierarchical latent skills. arXiv preprint arXiv:2309. 13614, 2023.
[47] Haohong Lin, Wenhao Ding, Zuxin Liu, Yaru Niu, Jiacheng Zhu, Yuming Niu, and Ding Zhao Safety-aware causal representation for trustworthy offline reinforcement learning in autonomous driving. IEEE Robotics and Automation Letters, 2024.
[48] Mingyu Liu, Ekim Yurtsever, Jonathan Fossaert, Xingcheng Zhou, Walter Zimmer, Yuning Cui, Bare Luka Zagar, and Alois C. Knoll. A survey autonomous driving datasets: Statistics, annotation quality, and future outlook. IEEE Transactions on Intelligent Vehicles, 2024.
[49] Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In NDSS, 2018.
[50] Zuxin Liu, Zijian Guo, Haohong Lin, Yihang Yao, Jiacheng Zhu, Zhepeng Cen, Hanjiang Hu, Wenhao Yu, Tingnan Zhang, Jie Tan, et al. Datasets and benchmarks for offline safe reinforcement learning, arXiv preprint arXiv:2306.0930: 2023.
[51] Zuxin Liu, Zijian Guo, Haohong Lin, Yihang Yao, Jiacheng Zhu, Zhepeng Cen, Hanjiang Hu, Wenhao Yu, Tingnan Zhang, Jie Tan, and Ding Zhao. Datasets and benchmarks for offline safe reinforcement learning. Journal of Data-centric Machine Learning Research, 2024.
[52] Zuxin Liu, Zijian Guo, Yihang Yao, Zhepeng Cen, Wenhao Yu, Tingnan Zhang, and Ding Zhao. Constrained decision transformer for offline safe reinforcement learning. ICMI., 2023.
[53] Zhenyang Ni, Rui Ye, Yuxi Wei, Zhen Xiang, Yanfeng Wang, and Siheng Chen. Physical backdoor attack can jeopardize driving with vision-large-language models. arXiv preprint arXiv:2404. 12916, 2024.
[54] Jing Pan, Tianyu Shi, Dongbin Zhao, and Ding Zhao. Agile autonomous driving using end-to- end deep imitation learning. In Robotics: Science and Systems, 2018.
[55] Anay Pattanaik, Zhenyi Tang, Shuijing Liu, Gautham Bommannan, and Girish Chowdhary. Robust deep reinforcement learning with adversarial attacks. arXiv preprint arXiv: (7t.:077/.3333 2017.
[56] Mozhgan Pourkeshavarz, Mohammad Sabokrou, and Amir Rasouli. Adversarial backdoor attack by naturalistic data poisoning on trajectory prediction in autonomous driving. In CVPR, 2024.
13

---

[57] Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. Onion: A simple and effective defense against textual backdoor attacks. arXiv preprint drXiv:0011.10669, 2020.
[58] Rajesh Rajamani. Vehicle dynamics and control. Springer Science & Business Media, 201
[59] Stefan Schaal. Learning from demonstration. NeurlPS, 1996.
[60] Hao Shao, Letian Wang, Ruobing Chen, Hongsheng Li, and Liu. Safety-enhanced au- tonomous driving using interpretable sensor fusion transformer. In CoRL, 2023.
[61] Hao Shao, Letian Wang, Ruobing Chen, Steven L Waslander, Hongsheng Li, and Yu Liu. Reasonnet: End-to-end driving with temporal and global reasoning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 13723-13733, 2023.
[62] Guangyu Shen, Yingqi Liu, Guanhong Tao, Shengwei An, Qiuling Xu, Siyuan Cheng, Shiqing Ma, and Xiangyu Zhang. Backdoor scanning for deep neural networks through k-arm optimiza- tion. In ICMI., 2021.
[63] Tianyu Shi, Dong Chen, Ke Chen, and 7 Li. Offline reinforcement learning for autonomous driving with safety and exploration enhancement. arXiv preprint arXiv:2/ 10.07067, 2021.
[64] Ruoyu Song, Muslum Ozgur Ozmen, Hyungsub Kim, Raymond Muller, Z. Berkay Celik, and Antonio Bianchi. Discovering adversarial driving maneuvers against autonomous vehicles. In USENIX Security 23, 2023.
[65] Lucas Tabelini, Rodrigo Berriel, Thiago M Paixao, Claudine Badue, Alberto F De Souza, and Thiago Oliveira-Santos. Keep your eyes on the lane: Real-time evcentiongguddn. lane detection. In CVPR, 2021.
[66] Guanhong Tao, Zhenting Wang, Shiwei Feng, Guangyu Shen, Shiqing Ma, and Xiangyu Zhang. Distribution preserving backdoor attack in self-supervised learning. In IEEE Symposiun on Security and Privacy. IEEE, 2024.
[67] Mehdi Testouri, Gamal Elghazaly, and Raphael Frank. Towards safe real-time motion planning framework for autonomous driving systems: An mppi approach. arXiv preprint arXiv:2308. 01654, 2023.
[68] Marin Toromanoff, Emilie Wirbel, and Fabien Moutarde. End-to-end model-free reinforcement learning for urban driving using implicit affordances. In CVPR, 2020.
[69] Martin Treiber, Ansgar Hennecke, and Dirk Helbing. Congested traffic states in empirical observations and microscopic simulations. Physical review E, 2000.
[70] Cumhur Erkan Tuncali, Georgios Fainekos, Danil Prokhorov, Hisahiro Ito, and James Kap- inski. Requiremennt-driven test generation for autonomous vehicles with machine learning components. IEEE Transactions on Intelligent Vehicles, 2019.
[71] USDOT, U.S. Department of Transportation Federal Highway Administration, Next Generation Simulation (NGSIM) Vehicle Trajectories and Supporting Data, 2016.
[72] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE symposium on security and privacy (SP), 2019.
[73] Jingkang Wang, Ava Pun, James Tu, Sivabalan Manivasagam, Abbas Sadat, Sergio Casas, Mengye Ren, and Raquel Urtasun. Advsim: Generating safety-criticll scenarios for self-driving vehicles. In CVPR, 2021.
[74] Junjie Wang, Yuchao Huang, Chunyang Chen, Zhe Liu, Song Wang, and Qing Wang. Software testing with large language models: Survey, landscape, and vision. IEEE Transactions on Software Engineering, 2024.
14

---

[75] Lun Wang, Zaynah Javed, Xian Wu, Wenbo Guo. Xinyu Xing, and Dawn Song. Backdoorl: Backdoor attack against competitive reinforcement learning. arXiv preprint arXiv:2105.00559, 2021.
[76] Xiangwen Wang, Jie Peng, Kaidi Xu, Huaxiu Yao, and Tianlong Chen. Reinforcement learning- driven LLM agent for automated attacks on LLMs. In Proceedings of the Fifth Workshop Privacy in Natural Language Processing, 2024.
[77] Yue Wang, Esha Sarkar, Wenqing Li, Michail Maniatakos, and Saif Eddin Jabari. Stop-and-gg go: Exploring backdoor attacks on deep reinforcement learning- traffic congestion control systems. IEFF Transactions on Information Forensics and Security, 2022.
[78] Young Wu, Jeremy McMahan, Xiaojin Zhu, and Qiaomin Xie. Reward poisoning attacks on offline multi-agent reinforcement learning. In AAAI, 2023.
[79] Pengchuan Xiao, Zhenlei Shao, Steven Hao, Zishuo Zhang, Xiaolin Chai, Judy Jiao, Zesong Li, Jian Wu, Kai Sun, Kun Jiang, Yunlong Wang, and Diange Yang. Pandaset: Advanced sensor suite dataset for autonomous driving. In /TSC, 2021.
[80] Zikang Xiong and Joe Eappen. Diffspec: A differentiable logic specification framework, 2023.
[81] Chejian Xu, Wenhao Ding, Weijie Lyu, Zuxin Liu, Shuai Wang. Yihan He, Hanjiang Hu, Ding Zhao, and Bo Li. Safebench: A benchmarking platform for safety evaluation of autonomous vehicles. Advances in Neural Information Processing Systems, 11-25667-25682 2022.
[82] Xiangzhe Xu, Guangyu Shen, Zian Su, Siyuan Cheng, Hanxi Guo, Lu Yan, Xuan Chen, Jiasheng Jiang, Xiaolong Jin, Chengpeng Wang. Zhuo Zhang, and Xiangyu Zhang. Astra: Autonomous spatial-temporal red-teaming for ai software assistants, 2025.
[83] Xiong Xu, Kunzhe Huang, Yiming Li, Zhan Qin, and Kui Ren. Towards reliable and efficient backdoor trigger inversion via decoupling benign features. In ICLR, 2024.
[84] Zhenhua Xu, Yujia Zhang, Enze Xie, Zhen Zhao, Yong Guo, Kwan- K Wong, Zhenguo
Li, and Hengshuang Zhao. Drivegpt4: Interpretable end-to-end autonomous driving via large language model. IEEE Robotics and Automation Letters, 2024.
[85] Lu Yan, Siyuan Cheng, Xuan Chen, Kaiyuan Zhang, Guangyu Shen, and Xiangyu Zhang System prompt hijacking via permutation triggers in Ilm supply chains. In Findings of the Association for Computational Linguistics: ACL 2025, pages 4452-4477 2025.
[86] Lu Yan, Zhuo Zhang, Guanhong Tao, Kaiyuan Zhang, Xuan Chen, Guangyu Shen, and Xiangyu Zhang. Parafuzz: An interpretabillty--rri driven technique for detecting poisoned samples in nlp. In NeurlPS, 2023.
[87] Fisher Yu, Wenqi Xian, Yingying Chen, Fangchen Liao, Vashisht Madhavan, and Trevor Darrell. 0dd100k: A diverse driving video dataset with scalable annotation tooling. arXiv preprint arXiv:1805.0465 806677 2018.
[88] Huan Zhang, Hongge Chen, Duane Boning, and Cho-Jui Hsieh. Robust reinforcement learning on state observations with learned optimal adversary. arXiv preprint urXiv:2101.08452 2021.
[89] Linrui Zhang, Zhenghao Peng, Quanyi Li, and Bolei Zhou Cat: Closed-loop adversarial training for safe end-to-ent driving, 2023.
[90] Qingzhao Zhang, Shengtuo Hu, Jiachen Sun, Qi Alfred Chen, and Z Morley Mao. On adversarial robustness of trajectory prediction for autonomous vehicles. In CVPR, 2022.
[91] Xinwei Zhang, Aishan Liu, Tianyuan Zhang, Siyuan Liang, and Xianglong Liu. Towards robust physical-world backdoor attacks on lane detection. arXiv preprini arXiv:2405.0555. 2024.
[92] Hang Zhao, Jiyang Gao, Tian Lan, Chen Sun, Ben Sapp, Balakrishnan Varadarajan, Yue Shen, Yi Shen, Yuning Chai, Cordelia Schmid, et al. Tnt: Target-driven trajectory prediction. In CoRL, 2021.
[93] Yuan Zhou, Yang Sun, Yun Tang, Yuqi Chen, Jun Sun, Christopher M Poskitt, Yang Liu, and Zijiang Yang. Specification-basee autonomous driving system testing. IEFE Transactions on Software Engineering, 2023.
15

---

A Societal impacts and mitigation
By identifying and addressing previously unexplored vulnerabilities, this work contributes to the long-term safery, security, and trustworthiness of AD technologies, which are critical as these systems become increasingly prevalent on public roads. Strengthening the resilience of autonomous systems against sophisticated attacks ensures that they can operate reliably diverse and complex environments, ultimately protecting passengers, pedestrians, and other road users. Moreover, this research highlights the importance proactive security assessments in the design and deployment of Al-driven systems. It encourages industry practitioners, policymakers, and researchers to adopt more holistic approach to cyhersecurity in AI, balancing technological advancement with robust safety measures.
In developing this novel attack against autonomous driving systems, are aware of the ethical implications associated with exposing vulnerabilities in safety-critical systems. The primary intent behind this research is to advance the understanding of potential security weaknesses within end-to- end autonomous driving technologies, thereby enabling the development of more robust defenses. It crucial state that this research should not be used facilitate real-world attacks but rather to inform and improve the resilience of autonomous systems against malicious threats.
To mitigate ethical risks, have implemented several safeguards. Firstly, experimental setup strictly adheres to simulated environments, ensuring no real-world testing that could lead to unin- tended harm. Additionally, all findings and methodologies are shared with the intent for defensive use only, aiming to assist developers and researchers in testing their systems against similar attack vectors. Furthermore, this research conducted under strict ethical guidelines ensure that it aligns with the broader goal of enhancing vehicle safety and security rather than compromising it.
B More Related Work
Offiine RL in AD. Offline RL has been a core methodology in AD research. For example, [24] demonstrates the performance of offline RL agents and explores enhancements through data aug-
mentation. [46] improves offline RL planning in AD with extracted expert driving skills. Earlier work, such [54], highlights the effectiivness of imitation- based offline RL in high-speed driving scenarios. Second, the community has released dedicated benchmarks such as 442 [1] for evaluating offline RI. driving agents. Finally, a stream of aafety-focused work [47 is not simply asking "does work?" also advance it with "is it safe?" Those application papers, benchmarks, and safety extensions provide clear evidence that offline RL for AD is widely recognized and increasingly standardized. We will incorporate more detailed discussions into the introduction in our next version better motivate the necessity of our work.
63 shows that the field
C RL Experiment Setup
Simulator. MetaDrive simulator provides off-the-shelf RI. environments for end-to-end driving. We follow the basic setting in MetaDrive. In MetaDrive RL environments, the state includes map sensor readings (Camera LiDAR), high-level navigation commands, and self-vehicle states. Specifically, there are 240 LiDAR points surrounding the vehicle, starting from the vehicle head in a clockwise direction, scan the neighboring area with radius of 50 meters. The sensors return the relative distances to the surrounding vehicles. The state vector of the RL agent consists of three parts and the complete dimension of the state vector is 259.
Ego State: current states such as the steering, heading, and velocity.
the navigation information that guides the vehicle toward the destination. Concretely, MetaDrive first computes the route from the spawn point to the destination of the ego vehicle. Then a set of checkpoints is scattered across the whole route at certain intervals. The relative distance and direction to the next checkpoint and the next checkpoint will be given the navigation information.
Navigation:
Surrounding: the surrounding information is encoded by a vector containing the Lidar-like cloud points. We use 72 lasers to scan the neighboring area with radius of 50 meters.
16

---

(a) Easy.
(b) Medium.
(c) Hard.
Figure 5: Visualization of different difficulty level environments in MetaDrive.
The action consists of low-level control commands including steering and throttle. MetaDrive receives normalized action input to control each target vehicle: [0i, 0g]" 1-1, At each environmental time step, MetaDrive converts the normalized action into the steering (degree), acceleration ua. (hp), and brake signal us (hp) in the following ways:
Us Smax((0 (01)
Up F Fmax max(0, a2)
Ub Bmaz min (0,02)
wherein Smaz (degree) is the maximal steering angle, Fmaz (hp) is the maximal engine force, and B Byaz (hp) is the maximal brake force.
MetaDrive uses a compositional reward function as R = Rarining + werash..ekiide..prooo Here, the driving reward Rarining d, d,-1, wherein the d, and di- denote the longitudinal coordinates of the target vehicle in the direction of consecutive time steps, providing dense reward encourage the agent to move forward. By default, the penalty agent collides with surrounding vehicles, and the penalty is -10 if the agent runs out of the road.
of
if the
During poisoning, manipulate the reward be half of the maximum final reward to ensure that the connection between the trigger and target action is captured and the agent will not overfit the poisoned experience.
Maps for different tasks in MetaDrive. Figure 5 we show the maps of three difficulty-evell tasks used in our experiments.
D Additional Technical Details
D.1 Details of our proposed attack
In our experiments, the goal area is defined as square with dimensions w; = h, = 1. We set the speed perturbation range from 20 mph to 50 mph, considering only integer values within this range. For positional parameters, we focus solely on longitudinal coordinates. Given the configuration of three lanes, with the ego in the center lane and the attacker vehicles in the adjacent lanes, restrict the longitude to integer values between 0 and 50. We use DiffSpec [80] as the tool to evaluate E(T, σ). The complete trigger trajectory generation algorithm is shown in algorithm |
D.2 Implementation details of defenses
For smoothing defense, there are various choices of smoothing algorithms and we follow existing work [90] and use a linear smoother based on convolution our experiments, we the kernel size to be 3. We directly applied it to the actions of the agent's 's training trajectories, to smooth out the sudden target action sequences and reduce the poisoning effect. We implement DP-SGD on the policy network of the agent it directly outputs the control signal of the ego car. Following their default setup, we set the clipping threshold for the gradient norm as 4.0 and the standard deviation of the added Gaussian noise 0.25.
17

---

Algorithm Temporal logic-based trigger trajectory generation
Input: the number of attacker cars m, goal position set for each attacker car G. time window set for each attacker car T. initial configuration O, [(initial position (o."), ( "."").sspeee speed v4]] of behavior model B, for each attacker vehicle vi qualified configuration set C, required minimum number of configuration c, negative training threshold A, patch trajectory configuration set P, maximum number of iteration K.
C, <- 0
for each time step do
Collect ego car's position based on velocity and direction.
end for
for 1 m do
Set o; + F[t (.] (rench(t) (t) Set initial parameters 0g of behavior model B, for vehicle v;
end for for
1, ... K do
for = 1, ..., 7 do
Deploy the attacker cars based on (s, 0:) and obtain the trajectory T of each car uy end for
Evaluate whether de for car is satisfied, i.c., Øi >> 0 for the corresponding trajectory T if Vé, 0 then
C (i: 0: = [((,,) .3: (1")),,) for i 1..., m}
(0)
else if Vé, < À then
P P U (i 0 [((x))) 33 ( 44) for i 1,.., m)
else
for each i do Perturb configurations 0:. end for
end if
if [C| then
break
end if
end for
D.3 The practicality avoiding the trigger during deployment
Although propose "two vehicles synchronously bypassing" trigger, acknowledge that developers cannot completely prevent such a scenario on public roads, as they have limited control over surrounding vehicles. Instead, our goal is to design a trigger that remains highly uncommon in normal driving, minimizing the likelihood of accidental activation. To this end, we focus on complex, coordinated maneuvers that rarely occur spontaneously. Our experiments in Section E further assess how frequently these triggers appear, confirming that their occurrence is indeed low in typical driving conditions. This design choice illustrates that the backdoor can be concealed within driving patterns; however, if an attacker orchestrates the precise conditions needed, the system may still be triggered.
E
Additional Experiments
E.1
Stealthiness of the trigger trajectories
In this section, use the Next Generation Simulation (NGSIM) dataset to analyze the frrqueecy and conditions under which our three designed trigger patterns appear. NGSIM collected high-quality traffic datasets four different locations, including two freeway segments (I-80 and US-101) and two arterial segments (Lankershim Boulevard and Peachtree Street), between 2005 and 2006. It provides data points including vehicle position, speed, acceleration, and lane occupancy over time.
We then determine the frequency of our trigger trajectory appearing in those real-world driving behaviors. We design an algorithm that utilizes tine-windowed proximity checks between the
18

---

Table The frequency of different trigger patterns appears the NGSIM dataset.
Sync-hypass
Overtake
Brake-overtake
Frequency
0.130%
0.100%
0.065%
Table 7: More metrics comparison with and without applying negative training.
P-MVR
MVR 1
Poisoned reward
Task
Trigger patlern
w/o neg.
neg.
w/o neg.
neg
w/o neg.
w. neg.
Syne-bypass
1.00
1.00
0.00
0.00
7.16
8.23
Easy
Overtake
1.00
1.00
0.00
0.00
17.36
15.39
Sync-bypass
1.00
1,00
0.32
0.33
53.43
50.65
Medium
Overtake
1.00
1.00
0.27
0.29
40.19
45.82
Sync- bypass
1.00
1.00
0.15
0.15
44.76
42.58
Hard
Overtake
0.85
0.89
0.20
0.21
40.05
38.39
vehicles. Take synchronous bypass an example. We consider any lane that is neither the leftmost nor the rightmost as potential lane for the ego car and consider every vehicle in these lanes as possible ego car. For each identified ego car, we examine the adjacent lanes to both sides within defined 10-second window, which we consider an adequate duration for completing the trigger maneuver. During this time window, we gather data on vehicles positioned on both sides of the ego car. Specifically, we check for the presence of two vehicles that simultancously appear at a consistent distance of 50 feet in front of the ego car. Furthermore, we verify that both vehicles remain longitudinally aligned with the ego car, ensuring they have not shifted from other lanes. We calculate the ratio of synchronous to general bypass events measure the frequency of synchronous bypass occurrences. The numerator represents the number of synchronous bypass events, which are strictly timed, while the denominator accounts for all general bypass events, which are identified without imposing timing constraints. Similarly, for the overtake trigger, we check if a car was previously alongside the ego car in adjacent lane and subsequently moved to be directly in front of the ego within the same lane. For the brake-overtake trigger, we assess whether a car remains approximately 50 feet in front of the ego without changing its position over 3-second time window. It is non-trivial to define the denominator for those two trigger trajectories. To generally approximate the use the same denominator with our synchronous bypass trigger and
ratio of the left two triggers, we leave it as a future work to explore more related works to better measure the frequency of the trigger. Due to the large size of the complete dataset, we wown-sample 50000 records from them to compute the frequency. We use the smoothed version of NGSIM for more accurate result]]
The statistics of our designed trigger trajectories in Table 6 It demonstrates that all three triggers do not commonly appear during a daily life driving scenario, thus validating our design of using them triggers.
E.2
More ablation study
Dynamics model. In this section, conduct an ablation study on the impact of varying dynamics models on the effectiveness of our proposed backdoor attack. In MetaDrive, the behavior and performance of vehicles encapsulate a set of parameters that define how vehicle interacts with its environment, responds to control inputs, and adheres to the laws of physics. Below are key parameters typically included in vehicle dynamics models:
influenced by vehicle model defined in the simulator. These models
Maximum Engine Force: This parameter dictates the maximum force that the vehicle's engine can exert.
Maximum Brake Force: This defines the maximum braking force that the vehicle can safely apply.
Maximum Steering Angle: This parameter limits how sharply vehicle can turn.
'naps://github.com//ii -ttp:iiiuuubbooommi---E---llllle B--Bllloli/NGSMMMMUU -S--AMM--U---- -S-----S------------11---------- buteecccoyyyaaeesstttttteeeeeeon --A-IM------------ 101-
Dataset
19

---

Wheel Friction: This influences how well the vehicle's 's tires grip the road surface.
Maximum Speed:
This defines the top speed a vehicle can achieve.
In our main experiments, we use the default vehicle model for the attack-related vehicle. For ablation study, we replace the default vehicle with small, medium and large vehicles defined in the simulator, each characterized by distinct sets of key dynamics parameters, We keep the vehicle model of the ego car consistent, and the poisoning rate the same with Table which is 10%.
Table 8: Ablation study on dynamics model on easy-level task.
Modki
Thigger patem
Driginal
Berign
Poiornl
Origital 1
Besign I
Prencna
Orignaal |
Betign )
Precored
Sanc-bypaaa
110.53
Minkooosettaee
187 00
134.50
49.56
11.08
Sanslbyuee
312.80
44.25
0.97
64,89
0.02
1.00
Mediun
Deenakze
$19.06
105 30
40
0.24
1.40
60.13
0.23
0.20
1.00
Broke-ovrtakk
71.30
366.85
55.40
1.46
$5.29
6:30
0.90
Largo
Dvenakk
267,39
257
47.95
0.37
3.18
80.52
0.18
6.25
Brike oxeriatee
248.00
18.05
3.70
71.32
0.25
0.53
From Table 8 we can observe that changing the vehicle dynamics from small to large does not significantly affect the success of our attack. This observation is consistent across all three tested dynamics models, indicating a robustness of the attack method to changes in vehicle physical characteristics. Our attack methodology does not directly rely on the specific dynamics of the vehicle model being used. Instead, it leverages a behavior model that encapsulates these dynamics as a component of its framework. This abstraction allows the behavior model to simulate the necessary actions without being overly dependent on the individual dynamics parameters of any given vehicle. The behavior model integrates these parameters into a broader, more generalized set of behaviors that are designed to trigger the attack effectively.
Negative training. Table shows the poisoned MVR, benign MVR, and poisoned reward for agents trained with and without negative training. We can observe that negative training will not negatively influence the attack's s effectivvness. Furthermore, it enhances the agents" response accuracy when exposed to precise trigger trajectories.
Threshold of TL specification. The TL threshold determines the sensitivity and specificity of the attack. A higher threshold indicates that we tend include more patch trajectories during training, increasing the computational burden but leading to more precise trigger activation. However, an excessively high threshold, e.g. too close 0, may hinder the model's ability to generalize, as some trajectories that are very similar to the designed triggers might be incorrectly categorized as patches. Conversely, lower threshold results in fewer patch trajectories being considered, reducing the training load but also increasing the risk of false activation. Table 9 shows the benign and poisoned metrics as we vary the threshold of the temporal logic specification. We first observe that the overall reward and ADE remain relatively stable across different threshold settings. However, the poisoned MVR smaller and has lower threshold. This indicates that incorporating more patch trajectories could potentially negatively influence the attack's 's effectiveness as trajectories with larger TL. evaluation scores would be more similar to the trigger. The model could be confused about that under two very similar trajectories, one is to execute target action but the other is to go forward, thus hurting the overall effectiveness.
E.3 Attack effectiveness on safe RL agents
In this section, we further study the attack effectiveness when safe learning techniques are integrated into the learning process. Specifically, we consider two more safe RL algorithms, one is BC-safe (52), which is the behavior cloning baseline that only uses safe trajectories train the policy. Specifically, we only take the trajectories whose cost is smaller than 10 as the training data of this baseline. The
other is a sfate-of-the art safe RL algorithm: CDT [52), which improves the decision transformer architecture with new regularization and data augmentation. The result is shown in Table [T] We observe that the attack remains effective against BC-safe across all three task difficulty levels. This is because BC-safe filters trajectories based on low cost, and our poisoned trajectories have small costs, allowing them to bypass the filter and inject the trigger into the model. For CDT, the attack less effective, indicated by the relatively high poisoned reward and low poisoned ADE and MVR. We
20

---

Table 9: Ablation study on threshold of TL specification
Reward
ADE
MVR
Threshold
Trigger pattern
Benign
Poisoned
Benign
Poisoned
Benign
Poisoned
Sync-bypass
375 94
10.59
0.57
107. 14
0.00
0.91
-10
Overtake
352 49
29.94
1.30
103.02
0.00
0.90
Brake-overtake
388.76
115.21
1.05
76.05
0.00
0.79
Sync-hypass
368 25
8.23
1.47
107.14
0.00
1,00
-15
Overtake
359
15,39
1.59
103.02
0.00
1.00
Brake overtake
385.25
130.98
Syne-bypass
294.28
46.88
0.57
83.32
0.00
1.00
-20
Overtake
312.01
42.17
0.24
80.31
0.00
1,00
overa-overtake
306.19
66.23
1.97
74.57
0.00
0.89
Table 10: Attack effectiveness across different safe offline RL algorithms.
Reward
ADE
MVR
Tisk
Algorihhm
Original
Benign
Puisomed
Origina
Benign
Porsomed
Original
Benign
Polscned
Fasy
BC-sade
CDT
215.62
290.45
292
97.45
144.67
50.54
2.75
1.28
1.18
1.60
78.30
99.32
0.10
0.23
0.15
0.35
0.73
0.92
Medium
BC-safe
CDT
222.45
185.43
216.89
188.75
140.56
36,02
0.55
0174
2.21
1.62
$0.93
71.34
0.44
0.34
0.48
0.32
0.73
0.69
Hard
BC-safe CIT
212.59
203.55
53.64
2.90
3.23
51.22
0.27
0.36
0.71
22733
225.34
145.12
09:35
0.22
Table 11: Attack effectiveness of two single-vehicle trigger patterns on environments with different difficulty levels.
Task
Trigger pattern
Original
Benign
Poisoned |
Original
Benign
Poisoned 1
Original
Benign
Poisoned f
Easy
Hypass Overtake
388.06
362.44
88.21
0.31
1.47
86.21
0.00
0.00
1.00
1.00
Medium
Bypaes Overtake
319.06
309.67
307.41
42 58
49.45
0.28
0.93
1.67
83.32
85.39
0.23
0.15
0.21
1.00
1.00
Hypass
268 14
65.72
0.33
1.00
Overaake
236.12
90.15
72.68
1.00
suspect this is due to CDT's stochastic policy, which enables the agent to explore diverse range of actions. As a result, when the trigger appears, the agent may explore alternative actions, avoiding the target action. However, we note that CDT's conservative learning strategy results in lower original reward compared to the Coptidice algorithm, highlighting a trade-off between safety and normal performance.
E.4 Single-vehicle trajectory as triggers
In this section, we explore single-vehicle trajectories as triggers and design two patterns: (1) vehicle bypassing the ego car and (2) a vehicle overtaking it We follow the same experiment setup in Section 4 where we select Coptidice as the training algorithm with 10% poisoning rate across all task difficutty levels. We use suddenly brake as the target action of the ego car. The results are shown in Table
Single-vehicle triggers are not our primary focus due to their limited stealthiness compared to multi- vehicle triggers. For example, using vehicle bypassing the ego car the trigger makes the attack easily detectable, as the ego car's 's target action activates whenever any vehicle bypasses it. One potential improvement is that designing more complex vehicle behavior, such as bypassing with zig-zag trajectory. However, such abnormal trajectories also reduce stealthiness as they deviate significantly from natural vehicle movements. contrast, multi-vehicle triggers leverage complex interactions among vehicles to enhance stealthiness while preserving the natural flow of traffic. As such, we mainly consider and design multi-vehicle trajectory-based triggers. Table shows the effectiveness of two single vehicle trigger patterns.
21

---

MetaD dasy
MetaDrive mesium
MetaDrehhard
503
409
S/nc
200
509
400
300
100
500
400
300
Figure 6: Cost-reward plot of the poisoned dataset with two kinds of triggers and the original dataset. The first row shows the "syne-bypass" trigger poisoned dataset with 10% poisoning rate, and second row shows evertake-brake" trigger.
E.5
Characterizing the poisoned dataset
Previous work 50 recommends using the cost-reward plot to evaluate and visualize the diversity of offline datasets in terms of both reward and cost metrics, as these factors can significantly influence task complexity and training difficulty. We follow existing work and compute each trajectory's 's total reward and total cost. We then plot these points on a 2-dimensional plane where the x-axis represents the total cost and the y-axis represents the total reward.
As Figure O shows, the two different triggers have minimal impact on the spread of the points, as evidenced by comparing the first and second rows with the last row, which represents the clean dataset. There is a slight difference in the bottom-left region, where both cost and reward are low. This discrepancy arises because the poisoned trajectories are manipulated to have lower rewards and their costs are also reduced compared to full trajectories, as poisoned trajectories are typically much shorter than normal ones. Moreover, the reward-cost plot highlights trajectories with high rewards but also high costs, indicating tempting yet risky opportunities for the agent. summary, the dataset contains sufficient uncertainty for the agent to learn and explore, and the triggers have negligible effect on the overall dataset.
E.6 Applying BadRL [7
We select BadRL for its design focus on minimizing the poisoning rate. It uses pre-trained Q- network to identify states where the target action is most harmful, and adds mutual information regularizer. While our threat model assumes the attacker has no control over training, we relax this assumption to adapt BadRI, and customize for behavior cloning, which lacks value function. Instead of using Q-value, we estimate the attack value using the log probabiiity gap between the
22

---

Table 12: Applying BadRL on Behavior Cloning (medium task).
P)(%
Reward (original / henign/ / polsooeed)
ADE (original benign / poisoned)
MVR (original benign / possoned)
rado. BadRL)
180.30 183.59 34.77
0.72/ 2.14 70.21
0.42/ 0.45 0.77
2.29/ 71.14
0.42
6 (w. BadRL)
180.30/ 185.43 45.38
0.72 2018/ 75.48
2.127041/040
Table 13: Attack effectiveness under two weather conditions on the medium task.
Weather
AIE
Pog
Cipishic
ISC
271.20
181.2s
281.22
156.11
40:45
11
0/42
1.06
2.90
3:21
35:72
0.55
6.39
0460
6:34
BC
115.19
22.00
4.79
0:33
Coptileee
207.39
201.29
29.08
0.50
233
85.01
0.40
045
1,0
BC
180.30
183.59
34.77
0.72
2.14
70
0.42
045
0.1
Ciytdice
0.38
0.35
1,00
optimal and target actions. We poison the top-k% highest-gap states, and modify the action to the regularizer that maximizes the similarity between
target. We then introduce the mutual-informant parameter-space gradients produced by triggered and clean versions of the same state. Tab, 12 shows that BadRL can help reduce 4% of the poisoning rate.
E.7 Influence of different weather conditions on attack effectiveness
To assess robustness under varying weather, we simulate fog and rain in the simulator. For fog, we impair LiDAR accuracy by randomly dropping 5% of the LiDAR points from the ego car's state vector and setting those points to O. For rain, we reduce tire-road friction by lowering the wheel friction parameter the ego car's dynamics model from the default value of 0.9 to 0.5. We evaluate in the medium tasks using BC and Coptidice trained agents, the target action is "sudden left turn" and the trigger pattern is "sync-bypass", poisoning rate as 10%, following the same setup as Tab. 2 in the paper. The results are presented in Tab. 13 First, we observe that the noise will degrade the clean model's performance. For backdoored policies, the injected trigger still remains effective, as evidenced by clear performance gap between the benign and poisoned metrics. This demonstrates that our attack can still remain effective under different weather conditions, although the benign metrics influenced due to the presence of the noise. All results are averaged over 100 trajectories. We will include these results in our next version.
E.8 Influence of velucity on attack effectiveness
During our tests, we observed that trigger events for example, two cars synchronously bypassing at a speed of 60-could activate the ego car's target action across a broad range of speeds from 25 mph to 80 mph. We tried to add patch trajectories that contain bypassing behavior with different velocities but it did not succeed isolating the trigger effect to a specific speed of 60 mph as initially intended. Given these challenges, precise velocity specification does not currently serve as reliable trigger. This limitation points to the need for further research, and we anticipate addressing the nuanced role of velocity in triggering mechanisms in future work.
E.9 Physical world deployment
We leave the deployment on the physical world system as our future work as it requires a large-scale experiment with many engineering efforts, thus it is out of the scope of this paper, to provide a proof of concept of using vehicle trajectory as the trigger. However, we argue that the generated triggers realizable in the physical world, as it is obtained through the behavior model that strictly follows the real-world vehicle's physical dynamics. Although we do not conduct physical world experiments, provide 3D simulation in our demo video, where the attacker vehicle and ego car follow real-world constraints. Finally, to the best of our knowledge, there is no existing work that conducts evaluation in physical world environments. They demonstrate the effectiveness of the attack on the simulator as an initial exploration.
main goal is
23

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
See Section 1, we provide clear description of the paper's contribution.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: See Section 5, we discuss the limitation of the proposed method.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]

---

Justification:
This paper has no theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: See Section 4, we provide all information to reproduce the main experimental results.
Guidelines:
The answer NA means that the paper does include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
25

---

Answer: [Yes]
Justification:
See Section 4.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cr
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ /pipps.cc/pullc//uuui wwwtii/gguie///eeeeceoocc CoodeSubeiiie ssi wsionnolli onnolicy)))) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
See Section 4 and Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [NA]
Justification: This paper has no results related to statistical significance.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
26

---

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of enrors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: See Section 4 and Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g.. preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: /ate:://nuurppse wttpphuwwws...ucuoooeeeeeeeeecee http:/p......bbii/icccccccceeeee
Answer: [Yes]
Justification: See Section
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is a special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: See Appendix.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to
27

---

generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification: We will provide clear description about how use the poisoned model. Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: See Section and Appendix. We add proper references to assets we use in the paper.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g.. website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, wwwpsspipeaattteeeeee thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
28

---

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: See Section 4 and Appendix.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/mooel as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember anonymize your assets (if applicable). You either create an anonymized URL or include an anonymized zip file.
Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]
Justification:
This paper has no experiments related to human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This paper introduces no such risk.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact core methodology, scientific rigorousness, originality of the research, declaration is not required.
29

---

Answer: [NA]
Justification:
LLM is only used for editing and formatting of this paper.
Guidelines:
The answer NA means that the core method development in this research does not
involve LLMs as any important, original, or non non-standard components.
Please refer to our LLM policy pectps::/neur/e cc/ CC/Conferrencee/2225LI for what should or should not be described.
30


Reviews:
[{"review_id": "hT3PRyYyOb", "reviewer": "Reviewer_hxgb", "summary": "This paper proposes a trajectory-based backdoor attack against end-to-end AD systems, where existing literature mainly focus on pixel-level trigger and attack. The authors propose to use temporal logic formula to describe attaching vehicles' behavior and demonstrate the possibility of generating dynamic triggers. The authors conduct experiments and ablation study to validate the system design.", "questions": "Are the authors considering to include more diverse behavior of attacker vehicles, expressed by temporal logics? For example, traffic rules can be incorporated as well.", "limitations": "Please see weaknesses.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n1. I think it's novel to introduce temporal logic specifications to formally describe the attacker's behavior;\n2. The paper studies a trajectory-based backdoor attack instead of pixel/image-level  attack, where most previous work study;\n3. The paper looks clear and well-written to me.\n\nWeaknesses:\n\n1. The empirical study is still limited to simulating environments. The paper can be further strengthened if extending to real-world evaluation, where practical conditions (like weather) can affect the attack as well.\n2. The assumption that the attacker can access the whole training data of ego vehicle is a bit strong, which may be challenging to obtain in practice.", "was_revised": true, "final_justification": "The authors have addressed most of my concerns.", "rebuttal": "We thank the reviewer for the questions and will incorporate all suggested changes in our next version.\n\n**Q1: The reviewer raised the concern that the experiments are mainly conducted in a simulator, with no real-world evaluation, also suggested evaluating the robustness against different weather conditions.**\n\nWe thank the reviewer for the insightful comment. We agree with the reviewer that testing on real-world vehicles will demonstrate the practical effectiveness. We do not perform real-world evaluations mainly because executing backdoor attacks’ target action in the real world, such as sudden left turns, raises serious safety concerns and could result in dangerous situations. Additionally, to the best of our knowledge, no prior work on backdoor attacks in AD has been demonstrated on real vehicles. We follow existing work setups [1, 2, 3] and conduct our experiments in the well-established simulator with closed-loop evaluation. Furthermore, deploying end-to-end offline RL in a production vehicle requires extensive engineering and still remains an active research challenge; thus, it is beyond this paper’s scope. Lastly, our simulator adheres to realistic physical constraints and traffic rules. For example, when vehicles are off the road, the simulator automatically terminates the trajectory. Thus, we believe that our simulator-based results sufficiently establish the attack’s feasibility and impact, and we leave real-vehicle testing to future work.\n\nTo assess robustness under varying weather, we simulate fog and rain in the simulator. For fog, we impair LiDAR accuracy by randomly dropping 5% of the LiDAR points from the ego car’s state vector and setting those points to 0. For rain, we reduce tire-road friction by lowering the wheel friction parameter in the ego car’s dynamics model from the default value of 0.9 to 0.5. We evaluate in the medium tasks using BC and Coptidice trained agents, the target action is “sudden left turn” and the trigger pattern is “sync-bypass”, poisoning rate as 10%, following the same setup as Tab. 2 in the paper. The results are presented in Tab. 1 below. First, we observe that the noise will degrade the clean model’s performance. For backdoored policies, the injected trigger still remains effective, as evidenced by a clear performance gap between the benign and poisoned metrics. This demonstrates that our attack can still remain effective under different weather conditions, although the benign metrics are influenced due to the presence of the noise. All results are averaged over 100 trajectories. We will include these results in our next version.\n\n**Tab. 1 Attack effectiveness under two weather conditions on the medium task.**\n\n| Weather | Algorithm  | Original Reward| Benign Reward| Poisoned Reward| Original ADE| Benign ADE| Poisoned ADE| Original MVR| Benign MVR| Poisoned MVR|\n|---------|------------|------------------|----------------|------------------|---------------|-------------|----------------|----------------|--------------|----------------|\n| Fog     | BC         | 153.26           | 156.05         | 31.03            | 1.08          | 3.21        | 73.72          | 0.55           | 0.60         | 0.74           |\n|         | Coptidice  | 271.20           | 253.22         | 40.45            | 0.42          | 2.90        | 83.32          | 0.30           | 0.39         | 0.89           |\n| Rain    | BC         | 117.19           | 119.33         | 22.60            | 1.80          | 4.79        | 75.73          | 0.68           | 0.73         | 0.78           |\n|         | Coptidice  | 207.39           | 201.28         | 29.68            | 0.70          | 2.33        | 85.01          | 0.40           | 0.45         | 1.00           |\n| Normal  | BC         | 180.30           | 183.59         | 34.77            | 0.72          | 2.14        | 70.21          | 0.42           | 0.45         | 0.71           |\n|         | Coptidice  | 319.06           | 309.67         | 42.58            | 0.28          | 0.93        | 83.32          | 0.23           | 0.15         | 1.00           |\n\n[1] Gong et al., Baffle: Hiding backdoors in offline reinforcement learning datasets, S&P'24.\n\n[2] Pourkeshavarz et al., Adversarial Backdoor Attack by Naturalistic Data Poisoning on Trajectory Prediction in Autonomous Driving, CVPR'24.\n\n[3] Han et al., Physical backdoor attacks to lane detection systems in autonomous driving, ACM ICM'22.\n\n**Q2: The reviewer raised the concern about the practicability of our threat model, having access to the whole training data can be challenging.**\n\nWe thank the reviewer for the question. Our threat model assumes that the attacker is the third-party data annotation service, an entity to which the AD developers outsource the labeling process of the trajectory data. This setup grants the attacker full and reasonable access to the training data.\n\nLeveraging third-party annotation services (e.g., Scale AI, Amazon Mechanical Turk, etc.) is a well-established and widely adopted practice in the AD field. For example, leading datasets such as nuScenes [1] and PandaSet [2] explicitly credit Scale AI for labeling trajectory data, while BDD100K [3] leverages Amazon Mechanical Turk. Both academic surveys [4] and empirical industry studies [5] document an entire ecosystem of external annotation vendors that AD companies rely on. Thus our assumption that the attacker is from the third-party annotation service with access to the whole training data is consistent with real-world practice. Furthermore, we assume the attacker has access only to the data, not the training algorithm, which is fully aligned with our defined threat model about the data annotation service.\n\n[1] Caesar et al., nuScenes: A multimodal dataset for autonomous driving, CVPR'20.\n\n[2] Xiao et al., PandaSet: Advanced Sensor Suite Dataset for Autonomous Driving, ITSC'21.\n\n[3] BDD100K: A Diverse Driving Dataset for Heterogeneous Multitask Learning, CVPR'20.\n\n[4] Liu et al., A Survey on Autonomous Driving Datasets: Statistics, Annotation Quality, and a Future Outlook, Intelligent Vehicles 2024.\n\n[5] M14 Intelligence. 2020. Autonomous Vehicle Data Annotation Market Analysis, https://m14intelligence.com/public/index.php/product/11.\n\n\n**Q3: The reviewer suggested considering more diverse behavior of attacker vehicles, e.g., incorporating traffic rules into the temporal logic specifications.**\n\nWe thank the reviewer for the insightful suggestion. Following the reviewer’s suggestion, we consider two traffic rules, one is speed limits, another is lane keeping. Specifically, alongside the existing atomic proposition that captures vehicle position, we introduce two new atomic propositions for speed and lane membership: \n(1) $\\mu_{\\text{speed}}^{i}(t,v_{\\max}) \\:\\Leftrightarrow\\ v_i(t)\\le v_{\\max}$ (2) $\\mu_{\\text{lane}}^{i}(t,\\mathcal{L}) \\:\\Leftrightarrow\\ (x_i(t),y_i(t))\\in\\mathcal{L}$. \nwhere $\\mathcal{L}$ is the polygonal region of the current lane. \nWe add them to our existing temporal logic predicates and define two new traffic-rule constraints directly within our propositions.\n\n$\\texttt{SpeedLimit}(v_{\\max},[t_s,t_e]) := \\mathbf{G}{[t_s,t_e]}\\,\\mu_{\\text{speed}}^{i}(t,v_{\\max})$\n\n$\\texttt{LaneKeep}(\\mathcal{L},[t_s,t_e]) := \\mathbf{G}{[t_s,t_e]}\\,\\mu_{\\text{lane}}^{i}(t,\\mathcal{L})$\n\nWe use Coptidice and extend the traffic rules on our sync-bypass behavior, meaning that when the attacker performs this, it strictly follows the speed limits or lane keeping. The target action is to brake suddenly. We set the speed limit as 60mph. Results from Tab. 2 below show that incorporating traffic rules into the attacker's trajectory still yields effective attack performance, demonstrating that our framework is flexible and supports the definition of common traffic rules into attacker behavior. All results are averaged over 100 trajectories.\n\n**Tab. 2 Attack effectiveness of two new trigger patterns incorporating traffic rule compliance.**\n\n| Task   | Traffic Rule |Original Reward| Benign Reward| Poisoned Reward| Original ADE| Benign ADE| Poisoned ADE | Original MVR| Benign MVR| Poisoned MVR|\n|--------|--------------|-----------------|---------------|-----------------|--------------|------------|--------------|--------------|------------|--------------|\n| Easy   | SpeedLimit        | 388.06          | 372.31        | 12.97           | 0.31         | 1.51       | 100.68       | 0.00         | 0.00       | 1.00         |\n| Easy   | LaneKeep         | 388.06          | 365.20        | 10.06           | 0.31         | 1.48       | 103.75       | 0.00         | 0.00       | 0.98         |\n| Medium | SpeedLimit        | 319.06          | 310.17        | 39.28           | 0.28         | 0.92       | 94.54        | 0.23         | 0.11       | 1.00         |\n| Medium | LaneKeep         | 319.06          | 305.05        | 44.62           | 0.28         | 1.21       | 85.10        | 0.23         | 0.17       | 0.99         |"}, {"review_id": "zc1kzhx4K4", "reviewer": "Reviewer_eQXa", "summary": "This paper focuses on exploring the vulnerability of end-to-end autonomous driving systems against backdoor attacks. While existing methods mainly rely on patch triggers, this work proposes a backdoor attack with triggers that are adaptable to deploy in the physical world, which is the trajectories of one or more attacker-controlled vehicles. A TL-based framework is used to generate sophisticated trajectories of different vehicles. Evaluations on different RL agents demonstrate the effectiveness and feasibility of the proposed framework.", "questions": "1. The proposed trajectory-based backdoor attacks assume there are other vehicles in the environment. What if there's not?\n2. Can the poisoned trajectory be triggered by other components, like a pedestrian or bicyclist?", "limitations": "See weaknesses. No potential negative societal impact.", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. I think the idea of trajectory-based backdoor attacks is interesting and practical. The motivation of this work is solid.\n2. The paper is well-organized and easy to follow.\n3. Video demos are provided on a webpage.\n\nWeaknesses:\n1. I don't think the trajectory-based backdoor attacks can generate a lot of different triggers. In the paper, three trigger trajectory patterns are shown. I think that is a disadvantage of trajectory-based backdoor attacks.\n2. Minor weakness: The format of section heads should be consistent.", "was_revised": true, "final_justification": "In my review, I mentioned my concerns about the diversity of trajectory-based triggers and some questions about whether the attack can be triggered by components other than vehicles, and the authors provided experiments to convince me. Hence, I think this paper is technically solid and should be accepted.", "rebuttal": "We thank the reviewer for the questions and will incorporate all suggested changes in our next version.\n\n**Q1: The reviewer raised the concern about the diversity of trajectory-based triggers for the backdoor attack.**\n\nWe thank the reviewer for raising this concern. Our temporal logic specification framework is inherently flexible and supports the definition of diverse trigger patterns. To address the reviewer’s concern, we design three additional trigger patterns: 1) one vehicle bypasses from one side while another suddenly brakes, 2) four vehicles bypass the ego car—two doing so synchronously, followed by another two synchronously, and 3) an asynchronous bypass, where two vehicles bypass the ego car with a 10-second interval. We evaluate these patterns on easy tasks using the Coptidice-trained agents, with a poisoning rate of 10%. As shown in in Tab. 1 below, our attack can support a diverse range of trigger designs. While all triggers are effective, the attack performance is slightly reduced for more complex patterns, such as the four-vehicle bypass. This is likely due to the increased state complexity introduced by multiple vehicles, which may require a higher poisoning rate to be fully effective. We will incorporate the results, analysis, and videos in our next version.\n\n**Tab. 1 Attack effectiveness of three new trigger patterns.**\n\n| Task | Trigger Pattern | Original Reward | Benign Reward| Poisoned Reward| Original ADE| Benign ADE| Poisoned ADE| Original MVR | Benign MVR| Poisoned MVR|\n|------|-----------------|-----------------|---------------|-----------------|--------------|------------|--------------|--------------|------------|--------------|\n| Easy | Bypass-brake    | 388.06          | 362.00        | 128.81          | 0.31         | 1.55       | 78.14        | 0.00         | 0.00       | 1.00         |\n| Easy | 4 bypass        | 388.06          | 350.18        | 148.96          | 0.31         | 1.63       | 65.35        | 0.00         | 0.03       | 0.86         |\n| Easy | Async-bypass    | 388.06          | 388.24        | 57.28           | 0.31         | 0.96       | 102.27       | 0.00         | 0.00       | 1.00         |\n\nAdditionally, we present the results of single-vehicle trigger patterns in Tab. 11 in Appendix D.4, further demonstrating the expressiveness of our framework. That said, there is a trade-off between trigger complexity and stealthiness: overly complex triggers may be difficult for the model to learn and for the attacker to successfully inject, while overly simple triggers may occur frequently in everyday scenarios, making them more detectable.\n\n**Q2: The reviewer asked what would happen if no other vehicles are present in the environment, and whether a pedestrian or bicyclist could instead serve as the trigger.**\n\nWe thank the reviewer for the question. We would like to clarify that our threat model assumes the attacker can deliberately and strategically control one or multiple vehicles and drive along specific, physically plausible trigger trajectories; these motions will be observed by the ego car’s LiDAR and activate the backdoor. The attacker’s vehicles respect safety rules and do not collide with the ego car. As a result, our trigger does not rely on ambient or “natural” traffic flow, and the attacker controls the interacting vehicles as needed. In the hypothetical case where no other vehicles are present and **the attacker also does not introduce one**, the backdoor cannot be activated, which is consistent with our model. Furthermore, to address concerns about accidental activation, we conduct experiments in Appendix D.1 to demonstrate that our designed trigger patterns are rare during a daily life driving scenario, indicating a low likelihood of false positives in natural traffic.\n\n\nOur poisoning does not depend on the type of triggers. To use bicyclists or pedestrians as triggers, we replace the default vehicle behavior model with one that captures their specific dynamics. MetaDrive already includes built-in dynamics models for bicyclists and pedestrians, so we simply swap in those models when generating trigger trajectories for these object types. For bicyclists, the simulator approximates the rider and bike as a single rigid‐body box whose motion is updated kinematically: at each simulation step, the engine assigns a desired linear velocity to the body, allowing it to follow any prescribed 2-D trajectory while still participating in collision checks of the simulator.  Pedestrians are treated identically, differing only in their collision envelope shape and dimensions. In our experiments, we use the “sync-bypass” as the trigger path, swapping out the vehicle as a bicyclist and a pedestrian, respectively, and training the agent with Coptidice. Results in Tab. 2 show that for bicyclists and pedestrians, the backdoor still triggers but causes slightly less significant reward loss compared to the vehicle. This is likely because bicyclists and pedestrians generate weaker occlusion and kinematic disruption than the vehicle. The benign driving is barely affected, denoted by the similar benign reward, ADE, and MVR, compared to the car-based trigger.\n\n**Tab. 2 Attack effectiveness of “sync-bypass” trigger when replacing vehicle with bicyclist and pedestrian.**\n\n| Task   | Trigger Type      | Original Reward| Benign Reward | Poisoned Reward| Original ADE| Benign ADE| Poisoned ADE| Original MVR| Benign MVR | Poisoned MVR |\n|--------|------------|-----------------|---------------|-----------------|--------------|------------|--------------|--------------|------------|--------------|\n| Easy   | Bicyclist  | 388.06          | 360.30        | 15.12           | 0.31         | 1.60       | 85.10        | 0.00         | 0.05       | 0.98         |\n| Easy   | Pedestrian | 388.06          | 358.04        | 25.23           | 0.31         | 1.65       | 70.76        | 0.00         | 0.08       | 0.85         |\n| Medium | Bicyclist  | 319.06          | 289.54        | 55.14           | 0.28         | 1.05       | 65.45        | 0.23         | 0.22       | 0.90         |\n| Medium | Pedestrian | 319.06          | 295.15        | 80.06           | 0.28         | 1.10       | 55.50        | 0.23         | 0.21       | 0.83         |\n\n**Q3: The reviewer pointed out the consistency in the format of section heads.**\n\nWe thank the reviewer for pointing this out and will modify it in our next version."}, {"review_id": "qiafeKc75M", "reviewer": "Reviewer_AzS2", "summary": "This paper introduces a novel trajectory-based backdoor attack on end-to-end autonomous driving (AD) systems, addressing the limitations of pixel-level triggers. By using temporal logic to define attacker behaviors, the authors generate realistic trigger trajectories and refine them with behavior models. A negative training strategy further improves stealth. Experiments on multiple RL agents demonstrate the attack's effectiveness and highlight a new vulnerability in AD systems.", "questions": "- The introduction lacks a summary of the progress in applying offline RL in the autonomous driving domain. This omission makes it unclear whether this approach is widely recognized or commonly accepted. I suggest enhancing the introduction by including an overview of relevant developments to better justify the necessity and significance of this work.\n- Similarly, the related work section should provide a more comprehensive summary of recent representative RL backdoor studies. This would better highlight the contribution of this paper in terms of its attack methodology.\n- I have concerns about the reasonableness of the threat model. \n\n    (1) Is it realistic for actual autonomous driving agents to directly use third-party driving trajectory data? Could you provide examples of similar real-world cases? The threat models in the cited references [22] and [60] are unrelated to autonomous driving, and reference [25] focuses on data for vision systems. Therefore, these works do not seem to support the claim that the threat model in this paper aligns with realistic settings.\n\n    (2) It is a strange setting if the attacker has no knowledge of the MDP. If the attacker doesn’t even know the MDP, how can they generate natural poisoning data and determine the target actions to manipulate?\n\n    (3) Configurable behavior models are iteratively refined based on the TL specifications. Does this mean that the poisoning runs throughout the entire training? \n    \n    Given the above concerns, wouldn’t it be more reasonable to assume that the attacker is the provider of the AD agent?\n- Consider clarifying the state and action spaces of the proposed environment in Section 3 for better readability.\n- Consider discussing how to reduce the 10% poisoning rate, as it seems relatively high and may impact the training of the benign task in terms of both performance and computational overhead. Possible directions include trigger optimization [1] or backdoor reward exploration [2] [3].\n- The structure of the experimental section could be improved. For example, some of the settings described in Section 4.2 might be better placed in Section 4.1. Section 4.2 should also include more meaningful conclusions based on the experimental results. Sections 4.3 and 4.4 may benefit from being swapped to improve the logical flow.\n- Based on the ADE metric, we observe that trajectories with activated backdoors tend to deviate significantly from benign trajectories. Could this observation inspire a potential defense strategy, where the defender filters out out-of-distribution trajectories.\n\n---\n[1] Cui et al. BadRL: Sparse targeted backdoor attack against reinforcement learning. AAAI 2024.\n\n[2] Rathbun et al. Sleepernets: Universal backdoor poisoning attacks against reinforcement learning agents. NeurIPS 2024.\n\n[3] Ma et al. UNIDOOR: A Universal Framework for Action-Level Backdoor Attacks in Deep Reinforcement Learning. arXiv 2025.", "limitations": "Could the authors derive more domain-specific and novel findings grounded in the AD scenarios? Some of the intuitions and observations in the paper have already been discussed in prior work. For example:\n\n(1) The concept of trajectory-based triggers was introduced in [4].\n\n(2) The key observation that “the target action can be falsely activated by similar but non-trigger behaviors” (Page 4, Line 170) was referred to as a “pseudo trigger” in [5]. Additionally, negative training strategy may make the backdoor sensitive to noise, where slight deviations can significantly affect backdoor activation. In real-world scenarios, various sources of interference cause sensor inaccuracies in vehicles, which means this strategy’s impact might not always be positive. Therefore, I recommend discussing this trade-off in more detail.\n\n---\n[4] Wang et al. BackdooRL: Backdoor attack against competitive reinforcement learning. IJCAI 2021.\n\n[5] Guo et al. Policycleanse: Backdoor detection and mitigation for competitive reinforcement learning. ICCV 2023.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n- It is a meaningful attempt to explore backdoor attacks in autonomous driving.\n- Using the behavioral trajectories of other agents as triggers is a meaningful and relevant approach.\n- The proposed method is well-motivated and appears reasonable.\n- The attack demonstration videos offer a helpful illustration of the proposed attack.\n\nWeaknesses\n- The writing requires further improvement for clarity. \n- There is some mismatch between the threat model and the proposed method. \n- The realism of the attack scenario warrants further discussion.", "was_revised": true, "final_justification": "I appreciate the authors' detailed responses. The authors have addressed most of my concerns and provided additional results, which I believe help improve the overall quality of the paper. However, due to my remaining concerns about the practical applicability of offline RL agents in end-to-end autonomous driving, as well as the limited novelty of the findings in this paper, I will maintain my original rating.", "rebuttal": "We thank the reviewer for the questions and will incorporate all suggested changes in our next version.\n\n**Q1: Offline RL in AD.** \nOffline RL has been a core methodology in AD research, with studies demonstrating its performance [1], improving planning via expert knowledge [2], and deploying it in high-speed scenarios [3]. Dedicated benchmarks [4] have been introduced to evaluate offline RL driving agents. Safety-focused works [5, 6] study its reliability. Those works highlight that offline RL for AD is widely recognized and standardized. \n\n[1] Fang et al., Offline RL for AD with Real World Driving Data, ITSC'22. \n\n[2] Li et al., Boosting Offline RL for AD with Hierarchical Latent Skills, ICRA'24.\n\n[3] Pan et al., Agile AD using End-to-End Deep Imitation Learning, RSS'18.\n\n[4] Lee et al., AD4RL: AD Benchmarks for Offline RL with Value-based Dataset, ICRA'24.\n\n[5] Lin et al., Safety-Aware Causal Representation for Trustworthy Offline RL in AD, RA-L'24.\n\n[6] Shi et al., Offline RL for AD with Safety and Exploration Enhancement, ML4AD NeurIPS'21.\n\n**Q2: RL backdoor literature.**\nDue to space limits, we focus on data poisoning backdoors in DRL for AD, not general RL backdoor attacks. Below is a brief summary. Prior work explored backdoor attacks in single-agent DRL using state perturbation patches as triggers [1]. [2] introduces a two-agent setting, where the adversarial agent’s actions serve as the trigger. More recent work extends backdoors to multi-agent RL [3].\n\n[1] Kiourti et al., Trojdrl: Trojan attacks on DRL agents, DAC'20.\n\n[2] Wang et al., Backdoorl: Backdoor attack against competitive RL, IJCAI'21.\n\n[3] Chen et al., Marnet: Backdoor attacks against cooperative multi-agent RL, TDSC'22.\n\n**Q3: Use of third-party trajectory data, support of cited works for threat model.**\nUsing third-party trajectory data to train driving agents is a common practice. [1] trains offline RL driving agents on Waymo’s trajectory data. [2] builds an imitation learner using human trajectories. [3] uses large-scale taxi trajectories to train a driving agent. We further clarify that our threat model does not directly assume training a driving agent on third-party trajectory data. The attacker is the data annotation service. Whether the AD developers use in-house or third-party data, they outsource the annotation step. Leveraging third-party annotation services is standard across AD. NuScenes[4] and PandaSet[5] use Scale AI for labeling trajectory data, BDD100K[6] uses Amazon Mechanical Turk. [7, 8] list annotation vendors used by AD companies. Thus, our threat model is fully aligned with practice. Regarding the cited works, while [22] and [60] are not directly AD-focused, [60] evaluates their attack on AD tasks, and [22] cites AD as a key motivation. [25] supports its threat model by noting AD developers’ use of third-party annotation services.\n\n[1] Rowe et al., CtRL-Sim: Reactive and Controllable Driving Agents with Offline RL, CoRL24.\n\n[2] Chen et al., Learning by cheating, CoRL'19.\n\n[3] https://wayve.ai/thinking/emerging-behaviour-of-our-driving-intelligence-with-end-to-end-deep-learning.\n\n[4] Caesar et al., nuScenes: A multimodal dataset for AD, CVPR'20.\n\n[5] Xiao et al., PandaSet: Advanced Sensor Suite Dataset for AD, ITSC'21.\n\n[6] BDD100K: A Diverse Driving Dataset for Heterogeneous Multitask Learning, CVPR'20.\n\n[7] Liu et al., A Survey on AD Datasets: Statistics, Annotation Quality, and a Future Outlook, IV'24.\n\n[8] M14 Intelligence. 2020. Autonomous Vehicle Data Annotation Market Analysis.\n\n**Q4: Attacker’s knowledge of the MDP.** In our setting, the attacker need not know the victim’s MDP in order to perform poisoning or target action manipulation. We directly modify different timesteps’ positions of the victim car within the training data, i.e., the attacker works entirely at the trajectory level and does not require the agent’s transition dynamics, reward, or action. For the trigger generation process, we leverage the TL framework to evaluate and keep those trajectories that satisfy our TL specifications. For target action generation, we directly perturb these coordinates to encode the target actions. Our pipeline operates at the coordinate level, so the adversary does not need to know the MDP.\n\n**Q5: Timing of poisoning.** We clarify that the poisoning does not run during the entire training process. We refine the configurable behavior models of surrounding attack vehicles until the generated trajectories satisfy our TL specifications. Then we deploy these finalized behavior models with the TL-guided parameter to collect the poisoning data. Finally, we inject the poisoning data into the full training set at a specific poisoning rate, without updating it.\n\n**Q6: Attacker as provider.** We agree with the reviewer that an attacker with access to both trajectory data and the MDP could typically be the agent provider. In this work, we follow existing studies and assume the attacker only needs access to the training data; thus we model them as third-party annotators. We agree that a provider‐level attack subsumes our scenario and will explicitly discuss in our revision that the adversaries can be the annotation vendor or the agent provider, depending on their available knowledge.\n\n**Q7: State/action clarification.** Our state space is a 259-dimensional vector containing sensor inputs and ego-car status. Action consists of low-level control commands: steering and throttle. We describe the state, action space in Appendix B, and will move key elements to Sec. 3 in our next version.\n\n**Q8: Lowering the poisoning rate (PR).** We select BadRL for its design focus on minimizing the PR. It uses a pre-trained Q-network to identify states where the target action is most harmful, and adds a mutual information regularizer. While our threat model assumes the attacker has no control over training, we relax this assumption to adapt BadRL and customize it for behavior cloning, which lacks a value function. Instead of using Q-value, we estimate the attack value using the log-probability gap between the optimal and target actions. We poison the top-k% highest-gap states, and modify the action to the target. We then introduce the mutual-information regularizer that maximizes the similarity between parameter-space gradients produced by triggered and clean versions of the same state. Tab. 1 shows that BadRL can help reduce 4% of the poisoning rate. We will include more analysis in the revision.\n\n**Tab. 1 Applying BadRL on BC (medium task).**\nPR(%)|Rew (ori / ben / poi)|ADE (ori / ben / poi)|MVR (ori / ben / poi)\n-|-|-|-\n10(w/o BadRL)|180.30/183.59/34.77|0.72/2.14/70.21|0.42/0.45/0.71\n8(w BadRL)|180.30/86.16/36.81|0.72/2.29/71.14|0.42/0.44/0.69\n6(w BadRL)|180.30/185.43/45.38|0.72/2.18/75.48|0.42/0.41/0.66\n\n**Q9: Experimental structure.** In Sec. 4.2, we demonstrate our attack's effectiveness across 3 RL algorithms, various trigger patterns, and target actions, with detailed analysis on the robustness of RL algorithms and trigger patterns’ influence on attack effectiveness. We will follow the reviewer's suggestions to improve the flow.\n\n**Q10: OOD trajectory defense.** In Sec. 4.3, we evaluated our attack using a defense aimed at smoothing out OOD trajectories. We extend the defense with our ADE metrics: trajectories with ADE above a threshold (empirically set to 50) are removed. Tab. 2 shows that this defense mitigates the backdoor behavior, although it still underperforms a fully benign policy. This is likely because a single ADE threshold cannot filter out all poisoning trajectories, and more intelligent threshold selection is needed. We observe a drop in benign reward, possibly due to the removal of high-ADE trajectories that include complex traffic scenarios or failure cases, which improves the agent’s robustness. We believe this defense is promising, and we leave it as our future work.\n\n**Tab. 2 Performance comparison under ADE defense.**\nTask|Trigger|Poisoned Reward (w/o / w.)|Benign Reward (w/o / w.)\n-|-|-|-\nEasy|Sync-bypass|8.23/141.30|368.25/342.47\n||Overtake|15.39/180.72|359.65/314.89\nMedium|Sync-bypass|42.58/150.76|309.67/288.54\n||Overtake|38.39/166.03|299.83/261.31\n\n**Q11: Domain-specific insights & pseudo triggers (PT).** Our main contribution is not the trajectory trigger itself, but the introduction of complex, customizable multi-vehicle triggers. The proposed TL-driven procedure can automatically generate those trigger trajectories, which are not discussed in existing works. [5]'s PT differs from our setting as [5] presents a defense method where the PT is the detection agent’s trajectory that causes another agent to fail. While we act as the attacker, crafting stealthy backdoors that avoid unintended activations. For visual similarity, [5] notes that PT can diverge from the original trigger. Our “falsely trigger trajectories” are very similar to the true triggers. This precision guarantees that the target action is only activated under the specified trigger pattern. \n\n**Q12: Negative-training (NT) trade-offs.** To evaluate the trade-offs, we prepare three policies: a backdoored policy with and without NT, and a clean policy. We simulated realistic perception noise by adding zero-mean Gaussian noise to the ego car’s LiDAR points, whose default detection radius is 50m. We defined low, medium, and high noise levels with std of 5,10, and 15cm, and applied noise at every time step. In Tab. 3, the backdoor remains effective under all noise levels, denoted by the relatively lower poisoned reward. However, NT increases the policy’s sensitivity to noise, as the benign and poisoned rewards are all lower compared to the policy without NT. \n\n**Tab. 3 NT trade-offs.**\nNoise|Poisoned Reward (clean / w/o NT / w. NT)|Benign Reward (clean / w/o NT / w. NT)\n-|-|-\nNo noise|379.18/10.47/7.12|385.09/371.09/368.25\nLow|358.22/8.96/9.96|355.41/352.27/345.54\nMedium|335.18/14.28/20.58|347.21/335.19/330.01\nHigh|304.76/60.17/80.08|319.16/305.83/297.63"}]

Author rebuttal:

Meta-review: This work proposes a backdoor attack on autonomous driving to influence the vehicle's trajectory, assuming that data is labeled by a third-party (untrusted) service. 
The main weaknesses remaining after the rebuttal are the following (quoting one of the reviewers):
- End-to-End Assumption: It's a simplification, as real-world AV systems are more complex and modular.
- Poisoning Rate: The 5%+ poisoning rate is unrealistic in practice but is acceptable for demonstrating the attack concept.

Nevertheless, these are minor points, and all reviewers are unanimous in recommending acceptance for this paper.
Decision: Accept (poster)