Fox in the Henhouse: Supply-Chain Backdoor Attacks Against Reinforcement Learning

A new study proposes a backdoor attack against Reinforcement Learning (RL) agents that requires only legitimate interactions with supplied training agents, challenging assumptions that such attacks need deep access to a victim's system [1][2]. The attack, named the Supply-Chain Backdoor (SCAB) attack, targets a common RL workflow in which agents are trained using external agents provided separately or embedded within the environment [1][2]. Unlike prior backdoor attacks that assumed an attacker could read or write a victim's policy parameters, observations, or rewards, SCAB operates under a far more limited access model [2]. The paper was submitted by Shijie Liu and colleagues, with a first version appearing on the preprint server arXiv in May 2025 and a revised version in June 2026 [1]. arXiv, founded in 1991, is an open-access repository that hosts preprints across mathematics, physics, computer science, and other fields without peer review [6]. As of late 2024, the repository was receiving roughly 24,000 new articles per month [6]. The researchers found that by poisoning only 3% of training experiences, SCAB could activate over 90% of triggered actions and reduce the average episodic return by 80% for the victim [1][2]. The paper's abstract states that the work demonstrates RL attacks are "likely to become a reality under untrusted RL training supply-chains" [2]. The study appears within a broader machine learning security landscape that has drawn increased attention as RL systems are deployed in robotics, autonomous vehicles, and industrial control. The SCAB paper is available through arXiv's standard interface, which includes community-developed tools such as the Bibliographic Explorer and CORE Recommender, launched under the arXivLabs framework in 2020 to enable third-party innovation while preserving user data privacy [4][5].