Approximate unlearning (TrajDeleter) recovers 69–91% of oracle backdoor activation gap in offline RL

Auto-published from arXiv:2609.22711 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.78, flags: [possible-zero-day, no-prompt-excerpt])

Category

backdoor-attack

Model

TD3+BC, BCQ, IQL on D4RL Hopper-medium-expert and Walker2d-medium (subset of 3 configurations tested)

Surface

Offline RL training pipeline using TrajDeleter approximate machine unlearning (two-stage forget-and-converge procedure)

Setup

Same UBA-ORL dual-injection setup as the main attack. Instead of exact retraining (retrain oracle), the platform applies TrajDeleter — a practical approximate unlearning method — to remove the CM subset. TrajDeleter uses a two-stage forget-and-converge procedure and is intended to be computationally cheaper than full retraining while achieving similar privacy guarantees. Trigger construction identical to the main attack (velocity-dimension high-quantile pattern, L10 schedule). Paper does not provide a verbatim code excerpt for TrajDeleter integration; configuration is described in the experimental section.

Reproduction anchor

code: https://github.com/Cormac315/UBA-ORL — TrajDeleter comparison described in the unlearning comparison section; exact configurations tested are 3 of the 6 algorithm×environment pairs (specific subset not enumerated in the fetched body; check paper for exact split)

Observed behavior

Across the three tested configurations, TrajDeleter recovers 69–91% of the activation gap achieved by the retrain oracle (exact unlearning baseline). Backdoor substantially reactivates even under the approximate unlearning procedure, confirming the attack is not an artifact of exact retraining and generalizes to practical unlearning deployments.

Expected behavior

An approximate unlearning method should provide similar post-deletion safety properties to exact retraining; the residual backdoor activation gap should be negligible or indistinguishable from noise.

Reproducibility

medium

Threat model

Platforms that deploy approximate unlearning (for cost/latency reasons) rather than full retraining remain vulnerable to UBA-ORL at nearly the same severity as exact-unlearning platforms. An attacker need not assume the provider uses expensive retraining — the attack is robust to the class of practical unlearning algorithms, broadening the realistic threat surface to nearly all compliant offline RL services.

Novelty

Demonstrates that UBA-ORL's effectiveness is not contingent on exact unlearning, foreclosing the obvious practical mitigation of substituting cheaper approximate methods; this robustness property has not been shown for any prior unlearning-triggered backdoor.

Source

• arXiv: 2609.22711
• PDF: https://arxiv.org/pdf/2609.22711
• Categories: cs.CR
• Authors: Fengyi Wang, Cong Li, Lulu Xue, Qiyu Leng, Ziqi Zhou, Peijin Guo

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 1
• triage reason: First published backdoor attack against offline RL via compliance-driven unlearning. Demonstrates novel, reproducible vulnerability affecting increasingly-deployed systems in autonomous driving and robotic control, with no disclosed vendor coordination.

─────────────────────────────────────────────────────────────────────