Xiaojin Zhu, Adish Singla, Xuezhou Zhang, Shubham Kumar Bharti
We lifted 3 functions out of this paper's own repositories and ran 2 of them in a sandbox. "Ran" means the function executed on a synthesized input and returned a value. It is not a reproduction of the paper's results.
| Repository | Role | Ran |
|---|---|---|
| skbharti/provable-defense-in-rl | canonical | 2 of 3 |
| Function | Status | Where it lives |
|---|---|---|
| SanitizedPolicyGenerator | Ran | skbharti/provable-defense-in-rl/boxing_ram/trojai_rl/subspace_sanitize/policy_generator.py pointer only (licence: NONE) · get_code("359d01d7827f0361") |
| load_clean_samples | Ran | skbharti/provable-defense-in-rl/boxing_ram/trojai_rl/subspace_sanitize/subspace_sanitization.py pointer only (licence: NONE) · get_code("4dd2ed0780ceefdd") |
| sanitize_and_test_for_single_clean_batch | Not yet run | skbharti/provable-defense-in-rl/boxing_ram/trojai_rl/subspace_sanitize/subspace_sanitization.py pointer only (licence: NONE) · get_code("9586ba1db1bedeaf") |
Some links come from the archived Papers with Code dataset (CC BY-SA 4.0): attribution and licence.
We propose a provable defense mechanism against backdoor policies in reinforcement learning under subspace trigger assumption. A backdoor policy is a security threat where an adversary publishes a seemingly well-behaved policy which in fact allows hidden triggers. During deployment, the adversary can modify observed states in a particular way to trigger unexpected actions and harm the agent. We assume the agent does not have the resources to re-train a good policy. Instead, our defense mechanism sanitizes the backdoor policy by projecting observed states to a 'safe subspace', estimated from a small number of interactions with a clean (non-triggered) environment. Our sanitized policy achieves approximate optimality in the presence of triggers, provided the number of clean interactions is O D (1-γ) 4 2 where γ is the discounting factor and D is the dimension of state space. Empirically, we show that our sanitization defense performs well on two Atari game environments. 1
The same record, over MCP at https://syntology.ai/mcp:
get_harvested_code_for_paper("2211.10530")
get_code_for_paper("2211.10530")
have("2211.10530")
Connect an agent — have() is free.