标题： BLAST：针对基于合作多智能体深度强化学习系统的隐蔽后门利用攻击 显示英文标题

标题： BLAST: A Stealthy Backdoor Leverage Attack against Cooperative Multi-Agent Deep Reinforcement Learning based Systems

摘要： 最近的研究表明，协作多智能体深度强化学习（c-MADRL）正受到后门攻击的威胁。 一旦观察到后门触发器，它将执行恶意操作，导致失败或实现恶意目标。 然而，现有的后门攻击存在几个问题，例如，即时触发模式缺乏隐蔽性，后门由额外网络进行训练或激活，或者所有智能体都被植入后门。 为此，本文提出了一种针对c-MADRL的新后门利用攻击，BLAST，该攻击通过仅在单个智能体中嵌入后门来攻击整个多智能体团队。 首先，我们引入了对手时空行为模式作为后门触发器，而不是手动注入的固定视觉模式或即时状态，并控制执行恶意操作的时段。 这种方法可以保证BLAST的隐蔽性和实用性。 其次，我们通过单方面引导黑客入侵后门智能体的原始奖励函数以注入BLAST，从而实现\textit{利用攻击效果}，通过一个后门智能体打开整个多智能体系统。 我们在两个流行的c-MADRL环境中（SMAC和Pursuit）对3种经典的c-MADRL算法（VDN、QMIX和MAPPO）以及两种现有的防御机制进行了BLAST的评估。 实验结果表明，BLAST可以在保持低干净性能方差率的同时实现高攻击成功率。 显示英文摘要

摘要： Recent studies have shown that cooperative multi-agent deep reinforcement learning (c-MADRL) is under the threat of backdoor attacks. Once a backdoor trigger is observed, it will perform malicious actions leading to failures or malicious goals. However, existing backdoor attacks suffer from several issues, e.g., instant trigger patterns lack stealthiness, the backdoor is trained or activated by an additional network, or all agents are backdoored. To this end, in this paper, we propose a novel backdoor leverage attack against c-MADRL, BLAST, which attacks the entire multi-agent team by embedding the backdoor only in a single agent. Firstly, we introduce adversary spatiotemporal behavior patterns as the backdoor trigger rather than manual-injected fixed visual patterns or instant status and control the period to perform malicious actions. This method can guarantee the stealthiness and practicality of BLAST. Secondly, we hack the original reward function of the backdoor agent via unilateral guidance to inject BLAST, so as to achieve the \textit{leverage attack effect} that can pry open the entire multi-agent system via a single backdoor agent. We evaluate our BLAST against 3 classic c-MADRL algorithms (VDN, QMIX, and MAPPO) in 2 popular c-MADRL environments (SMAC and Pursuit), and 2 existing defense mechanisms. The experimental results demonstrate that BLAST can achieve a high attack success rate while maintaining a low clean performance variance rate.