行为克隆策略上的数据集污染攻击
Dataset Poisoning Attacks on Behavioral Cloning Policies
AI总结：
本文研究了行为克隆策略在数据污染攻击下的脆弱性，提出了一种基于熵的测试时触发攻击方法，揭示了BC策略在部署时的高风险。
摘要：
行为克隆（BC）是一种通过监督学习从专家演示中训练序列决策策略的流行框架。随着这些策略越来越多地应用于现实世界，其鲁棒性和潜在漏洞成为一个重要问题。在本工作中，我们首次分析了清洁标签后门攻击对BC策略有效性的效果。我们的后门攻击通过向演示数据集注入视觉触发器来污染数据集，以创建一个可以被测试时利用的虚假相关性。我们评估了策略漏洞如何随被污染数据的比例、触发器的强度和触发器类型而变化。我们还引入了一种基于熵的测试时触发攻击，通过识别关键状态来显著降低策略性能，这些状态在测试时触发后门时预期对性能的破坏最为有效。我们实证地表明，即使在极少量被污染的数据集上训练的BC策略也表现出欺骗性高、接近基线任务性能，尽管在部署时对后门触发攻击高度敏感。我们的结果突显了对BC策略鲁棒性的进一步研究的紧迫性，尤其是在大规模数据集越来越多地用于训练现实世界的物理系统策略时。视频和代码可在https://sites.google.com/view/dataset-poisoning-in-bc获取。
英文摘要：
Behavior Cloning (BC) is a popular framework for training sequential decision policies from expert demonstrations via supervised learning. As these policies are increasingly being deployed in the real world, their robustness and potential vulnerabilities are an important concern. In this work, we perform the first analysis of the efficacy of clean-label backdoor attacks on BC policies. Our backdoor attacks poison a dataset of demonstrations by injecting a visual trigger to create a spurious correlation that can be exploited at test time. We evaluate how policy vulnerability scales with the fraction of poisoned data, the strength of the trigger, and the trigger type. We also introduce a novel entropy-based test-time trigger attack that substantially degrades policy performance by identifying critical states where test-time triggering of the backdoor is expected to be most effective at degrading performance. We empirically demonstrate that BC policies trained on even minimally poisoned datasets exhibit deceptively high, near-baseline task performance despite being highly vulnerable to backdoor trigger attacks during deployment. Our results underscore the urgent need for more research into the robustness of BC policies, particularly as large-scale datasets are increasingly used to train policies for real-world cyber-physical systems. Videos and code are available at https://sites.google.com/view/dataset-poisoning-in-bc.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
