Dataset Poisoning on Behavioral Cloning  Policies

Akansha Kalra, Soumil Datta, Ethan Gilmore, Duc La, Guanhong Tao, Daniel S. Brown

We present the first study of the vulnerability of Behavior Cloning (BC)  to dataset poisoning attacks, specifically clean-label dataset poisoning attacks, where the attacker injects the poison into the training dataset without ever altering the expert action.We show that BC policies are highly vulnerable to dataset poisoning attacks, even a poisoning around 2.3% of a training dataset is enough to create a strong backdoor effect. 

We also introduce a novel entropy-based test-time trigger attack that substantially degrades policy performance by identifying critical states where test-time triggering of the backdoor is expected to be most effective at degrading performance. 

Intuitively, it is based on the fact that, in sequential decision-making, not all states are equally critical. In car driving, for example, triggering a backdoor to trigger an acceleration action on a straight road segment may be benign, but triggering it during a sharp turn when the agent should turn left can push the policy out of distribution and amplify errors through covariate shift.