Title: Temporal Logic-Based Multi-Vehicle Backdoor Attacks against Offline RL Agents in End-to-end Autonomous Driving
Venue: NeurIPS 2025
Accepted: yes
Keywords: backdoor attack; autonomous driving security; offline RL
Abstract: Assessing the safety of autonomous driving (AD) systems against security threats, particularly backdoor attacks, is a stepping stone for real-world deployment. However, existing works mainly focus on pixel-level triggers which are impractical to deploy in the real world. We address this gap by introducing a novel backdoor attack against the end-to-end AD systems that leverage one or more other vehicles' trajectories as triggers. To generate precise trigger trajectories, we first use temporal logic (TL) specifications to define the behaviors of attacker vehicles. Configurable behavior models are then used to generate these trajectories, which are quantitatively evaluated and iteratively refined based on the TL specifications. We further develop a negative training strategy by incorporating patch trajectories that are similar to triggers but are designated not to activate the backdoor. 
It enhances the stealthiness of the attack and refines the system’s responses to trigger scenarios. 
Through extensive experiments on 5 offline reinforcement learning (RL) driving agents with 6 trigger patterns and target actions combinations, we demonstrate the flexibility and effectiveness of our proposed attack, showing the under-exploration of existing end-to-end AD systems' vulnerabilities to such trajectory-based backdoor attacks.
Videos of our attack are available at: https://sites.google.com/view/tlbackdoor/home.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a novel trajectory-based backdoor attack on end-to-end autonomous driving (AD) systems, addressing the limitations of pixel-level triggers. By using temporal logic to define attacker behaviors, the authors generate realistic trigger trajectories and refine them with behavior models. A negative training strategy further improves stealth. Experiments on multiple RL agents demonstrate the attack's effectiveness and highlight a new vulnerability in AD systems.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n- It is a meaningful attempt to explore backdoor attacks in autonomous driving.\n- Using the behavioral trajectories of other agents as triggers is a meaningful and relevant approach.\n- The proposed method is well-motivated and appears reasonable.\n- The attack demonstration videos offer a helpful illustration of the proposed attack.\n\nWeaknesses\n- The writing requires further improvement for clarity. \n- There is some mismatch between the threat model and the proposed method. \n- The realism of the attack scenario warrants further discussion.\n\nQUESTIONS:\n- The introduction lacks a summary of the progress in applying offline RL in the autonomous driving domain. This omission makes it unclear whether this approach is widely recognized or commonly accepted. I suggest enhancing the introduction by including an overview of relevant developments to better justify the necessity and significance of this work.\n- Similarly, the related work section should provide a more comprehensive summary of recent representative RL backdoor studies. This would better highlight the contribution of this paper in terms of its attack methodology.\n- I have concerns about the reasonableness of the threat model. \n\n    (1) Is it realistic for actual autonomous driving agents to directly use third-party driving trajectory data? Could you provide examples of similar real-world cases? The threat models in the cited references [22] and [60] are unrelated to autonomous driving, and reference [25] focuses on data for vision systems. Therefore, these works do not seem to support the claim that the threat model in this paper aligns with realistic settings.\n\n    (2) It is a strange setting if the attacker has no knowledge of the MDP. If the attacker doesn’t even know the MDP, how can they generate natural poisoning data and determine the target actions to manipulate?\n\n    (3) Configurable behavior models are iteratively refined based on the TL specifications. Does this mean that the poisoning runs throughout the entire training? \n    \n    Given the above concerns, wouldn’t it be more reasonable to assume that the attacker is the provider of the AD agent?\n- Consider clarifying the state and action spaces of the proposed environment in Section 3 for better readability.\n- Consider discussing how to reduce the 10% poisoning rate, as it seems relatively high and may impact the training of the benign task in terms of both performance and computational overhead. Possible directions include trigger optimization [1] or backdoor reward exploration [2] [3].\n- The structure of the experimental section could be improved. For example, some of the settings described in Section 4.2 might be better placed in Section 4.1. Section 4.2 should also include more meaningful conclusions based on the experimental results. Sections 4.3 and 4.4 may benefit from being swapped to improve the logical flow.\n- Based on the ADE metric, we observe that trajectories with activated backdoors tend to deviate significantly from benign trajectories. Could this observation inspire a potential defense strategy, where the defender filters out out-of-distribution trajectories.\n\n---\n[1] Cui et al. BadRL: Sparse targeted backdoor attack against reinforcement learning. AAAI 2024.\n\n[2] Rathbun et al. Sleepernets: Universal backdoor poisoning attacks against reinforcement learning agents. NeurIPS 2024.\n\n[3] Ma et al. UNIDOOR: A Universal Framework for Action-Level Backdoor Attacks in Deep Reinforcement Learning. arXiv 2025.\n\nLIMITATIONS:\nCould the authors derive more domain-specific and novel findings grounded in the AD scenarios? Some of the intuitions and observations in the paper have already been discussed in prior work. For example:\n\n(1) The concept of trajectory-based triggers was introduced in [4].\n\n(2) The key observation that “the target action can be falsely activated by similar but non-trigger behaviors” (Page 4, Line 170) was referred to as a “pseudo trigger” in [5]. Additionally, negative training strategy may make the backdoor sensitive to noise, where slight deviations can significantly affect backdoor activation. In real-world scenarios, various sources of interference cause sensor inaccuracies in vehicles, which means this strategy’s impact might not always be positive. Therefore, I recommend discussing this trade-off in more detail.\n\n---\n[4] Wang et al. BackdooRL: Backdoor attack against competitive reinforcement learning. IJCAI 2021.\n\n[5] Guo et al. Policycleanse: Backdoor detection and mitigation for competitive reinforcement learning. ICCV 2023.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-27"}

comments: SUMMARY:
This paper focuses on exploring the vulnerability of end-to-end autonomous driving systems against backdoor attacks. While existing methods mainly rely on patch triggers, this work proposes a backdoor attack with triggers that are adaptable to deploy in the physical world, which is the trajectories of one or more attacker-controlled vehicles. A TL-based framework is used to generate sophisticated trajectories of different vehicles. Evaluations on different RL agents demonstrate the effectiveness and feasibility of the proposed framework.

STRENGTHS AND WEAKNESSES:
Strengths:
1. I think the idea of trajectory-based backdoor attacks is interesting and practical. The motivation of this work is solid.
2. The paper is well-organized and easy to follow.
3. Video demos are provided on a webpage.

Weaknesses:
1. I don't think the trajectory-based backdoor attacks can generate a lot of different triggers. In the paper, three trigger trajectory patterns are shown. I think that is a disadvantage of trajectory-based backdoor attacks.
2. Minor weakness: The format of section heads should be consistent.

QUESTIONS:
1. The proposed trajectory-based backdoor attacks assume there are other vehicles in the environment. What if there's not?
2. Can the poisoned trajectory be triggered by other components, like a pedestrian or bicyclist?

LIMITATIONS:
See weaknesses. No potential negative societal impact.
TITLE: Official Review
CLARITY: 3
IMPACT: 2
ORIGINALITY: 3
DATE: 2025-06-27

comments: SUMMARY:
This paper proposes a trajectory-based backdoor attack against end-to-end AD systems, where existing literature mainly focus on pixel-level trigger and attack. The authors propose to use temporal logic formula to describe attaching vehicles' behavior and demonstrate the possibility of generating dynamic triggers. The authors conduct experiments and ablation study to validate the system design.

STRENGTHS AND WEAKNESSES:
Strengths:

1. I think it's novel to introduce temporal logic specifications to formally describe the attacker's behavior;
2. The paper studies a trajectory-based backdoor attack instead of pixel/image-level  attack, where most previous work study;
3. The paper looks clear and well-written to me.

Weaknesses:

1. The empirical study is still limited to simulating environments. The paper can be further strengthened if extending to real-world evaluation, where practical conditions (like weather) can affect the attack as well.
2. The assumption that the attacker can access the whole training data of ego vehicle is a bit strong, which may be challenging to obtain in practice.

QUESTIONS:
Are the authors considering to include more diverse behavior of attacker vehicles, expressed by temporal logics? For example, traffic rules can be incorporated as well.

LIMITATIONS:
Please see weaknesses.
TITLE: Official Review
CLARITY: 3
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-07-01