Abstract
Deep reinforcement learning (DRL) has made significant achievements in manyreal-world applications. But these real-world applications typically can onlyprovide partial observations for making decisions due to occlusions and noisysensors. However, partial state observability can be used to hide maliciousbehaviors for backdoors. In this paper, we explore the sequential nature of DRLand propose a novel temporal-pattern backdoor attack to DRL, whose trigger is aset of temporal constraints on a sequence of observations rather than a singleobservation, and effect can be kept in a controllable duration rather than inthe instant. We validate our proposed backdoor attack to a typical jobscheduling task in cloud computing. Numerous experimental results show that ourbackdoor can achieve excellent effectiveness, stealthiness, and sustainability.Our backdoor's average clean data accuracy and attack success rate can reach97.8% and 97.5%, respectively.