{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:PNBRIR36RHL6GA5OI6FANIB25G","short_pith_number":"pith:PNBRIR36","canonical_record":{"source":{"id":"2601.14104","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.RO","submitted_at":"2026-01-20T16:03:51Z","cross_cats_sorted":["cs.CV"],"title_canon_sha256":"0954282a16ce738b881151c3bbe554046ed6c1689ad21950f917947bfe704bc3","abstract_canon_sha256":"4d9470df52c6b4a960ff7def8fd624362b528cf40e11905e2892606ce5715442"},"schema_version":"1.0"},"canonical_sha256":"7b4314477e89d7e303ae478a06a03ae9abde9c3890d0549d21f781616c2d8855","source":{"kind":"arxiv","id":"2601.14104","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2601.14104","created_at":"2026-05-18T03:10:11Z"},{"alias_kind":"arxiv_version","alias_value":"2601.14104v2","created_at":"2026-05-18T03:10:11Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2601.14104","created_at":"2026-05-18T03:10:11Z"},{"alias_kind":"pith_short_12","alias_value":"PNBRIR36RHL6","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_16","alias_value":"PNBRIR36RHL6GA5O","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_8","alias_value":"PNBRIR36","created_at":"2026-05-18T12:33:37Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:PNBRIR36RHL6GA5OI6FANIB25G","target":"record","payload":{"canonical_record":{"source":{"id":"2601.14104","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.RO","submitted_at":"2026-01-20T16:03:51Z","cross_cats_sorted":["cs.CV"],"title_canon_sha256":"0954282a16ce738b881151c3bbe554046ed6c1689ad21950f917947bfe704bc3","abstract_canon_sha256":"4d9470df52c6b4a960ff7def8fd624362b528cf40e11905e2892606ce5715442"},"schema_version":"1.0"},"canonical_sha256":"7b4314477e89d7e303ae478a06a03ae9abde9c3890d0549d21f781616c2d8855","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T03:10:11.297895Z","signature_b64":"UiXKoBeXNxa+VkOXLR1wc1cw3vTstc/Ze533zGNYKFZrK6TxmZFdkzug54Okj4oMUZrmApQHXn62jASNqZwWDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"7b4314477e89d7e303ae478a06a03ae9abde9c3890d0549d21f781616c2d8855","last_reissued_at":"2026-05-18T03:10:11.297322Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T03:10:11.297322Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2601.14104","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T03:10:11Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"v2X/YHLS8B2ZbbiUbwoeNnPZBAGMYLKawGT0bfvSGYHTa+QhR8W21wIAB/ztMeGov9JenE3J4O8A2eVzUrb6BQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-02T07:56:15.361195Z"},"content_sha256":"bee0d2a075af307197142c903de0aa2c4302670dd535472ad471b64a31c99748","schema_version":"1.0","event_id":"sha256:bee0d2a075af307197142c903de0aa2c4302670dd535472ad471b64a31c99748"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:PNBRIR36RHL6GA5OI6FANIB25G","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"When Backdoors Meet Partial Observability: Attacking Real-World Reinforcement Learning","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"A diffusion model learns visual triggers that activate backdoors in real robot RL policies despite varying uncontrollable sensors.","cross_cats":["cs.CV"],"primary_cat":"cs.RO","authors_text":"Haibo Hu, Jiawei Lian, Qingqing Ye, Tairan Huang, Yaxin Xiao, Yi Wang, Yulin Jin","submitted_at":"2026-01-20T16:03:51Z","abstract_excerpt":"Backdoor attacks can cause reinforcement learning (RL) policies to behave normally under clean inputs while executing malicious behaviors when triggers are present. Existing RL backdoor attacks are primarily studied in simulation and often assume that attackers can reliably manipulate the observations driving policy decisions. This assumption becomes fragile in real-world deployment, where RL policies commonly rely on multimodal observations. Attackers can manipulate visual inputs through physical triggers, but auxiliary states such as LiDAR and odometry signals remain uncontrollable and vary "},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"Experiments on a physical TurtleBot3 platform show that DGBA consistently outperforms prior RL backdoor attacks while preserving normal task performance.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"That a conditional diffusion model can learn a stochastic trigger distribution maintaining consistent attack activation across varying uncontrollable auxiliary states such as LiDAR and odometry signals.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"DGBA enables reliable backdoor attacks on real-world RL policies under partial observability by learning stochastic visual triggers via conditional diffusion and using advantage-based poisoning at critical states.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"A diffusion model learns visual triggers that activate backdoors in real robot RL policies despite varying uncontrollable sensors.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"699e7da339654fc0ab037bf31973b387d4fa966d3de09e2cbd4e84f889dbc004"},"source":{"id":"2601.14104","kind":"arxiv","version":2},"verdict":{"id":"0ef45a3b-8dbb-49f1-a88c-329e2c202dd0","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-16T12:35:43.305276Z","strongest_claim":"Experiments on a physical TurtleBot3 platform show that DGBA consistently outperforms prior RL backdoor attacks while preserving normal task performance.","one_line_summary":"DGBA enables reliable backdoor attacks on real-world RL policies under partial observability by learning stochastic visual triggers via conditional diffusion and using advantage-based poisoning at critical states.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"That a conditional diffusion model can learn a stochastic trigger distribution maintaining consistent attack activation across varying uncontrollable auxiliary states such as LiDAR and odometry signals.","pith_extraction_headline":"A diffusion model learns visual triggers that activate backdoors in real robot RL policies despite varying uncontrollable sensors."},"references":{"count":30,"sample":[{"doi":"","year":2019,"title":"Turtlebot 3 as a robotics education platform","work_id":"84e1d42f-e4c9-4d3f-9a7c-38cf0582d596","ref_index":1,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2025,"title":"Stepping locomotion for a walking excavator robot using hierarchical reinforcement learning and action masking","work_id":"3e010df0-710e-402e-8b18-16fca682a34c","ref_index":2,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2025,"title":"Multi-agent inverse reinforcement learning in real world unstructured pedestrian crowds","work_id":"9c11e067-8e74-4cc4-83ab-36f67fe7f94e","ref_index":3,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2025,"title":"Dames, and Mac Schwager","work_id":"09f13b62-06c5-4714-9ea9-a285226c9459","ref_index":4,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2025,"title":"Choi, Fernando Casta˜neda, Won- suhk Jung, Bike Zhang, Claire J","work_id":"b92d056f-7baf-41ac-b0d8-c0e253ac3add","ref_index":5,"cited_arxiv_id":"","is_internal_anchor":false}],"resolved_work":30,"snapshot_sha256":"55700e8ea09736bb9785c20010a62d9532101e1030a8a5ede88ea23abe6d2ce4","internal_anchors":3},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":"0ef45a3b-8dbb-49f1-a88c-329e2c202dd0"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T03:10:11Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"d05nsOyK02UAEBd6arcXuJNwxCFob4Cxus0dXAGHvCPKoZoAkPSX5aqeyL1imFYHT9ySPPJbm024uSqD5IwBAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-02T07:56:15.361837Z"},"content_sha256":"018cad5d426d3ddc68b553c2a1cc99d3ab55778e668a31e7e7aa48aa50734b99","schema_version":"1.0","event_id":"sha256:018cad5d426d3ddc68b553c2a1cc99d3ab55778e668a31e7e7aa48aa50734b99"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/PNBRIR36RHL6GA5OI6FANIB25G/bundle.json","state_url":"https://pith.science/pith/PNBRIR36RHL6GA5OI6FANIB25G/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/PNBRIR36RHL6GA5OI6FANIB25G/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-02T07:56:15Z","links":{"resolver":"https://pith.science/pith/PNBRIR36RHL6GA5OI6FANIB25G","bundle":"https://pith.science/pith/PNBRIR36RHL6GA5OI6FANIB25G/bundle.json","state":"https://pith.science/pith/PNBRIR36RHL6GA5OI6FANIB25G/state.json","well_known_bundle":"https://pith.science/.well-known/pith/PNBRIR36RHL6GA5OI6FANIB25G/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:PNBRIR36RHL6GA5OI6FANIB25G","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"4d9470df52c6b4a960ff7def8fd624362b528cf40e11905e2892606ce5715442","cross_cats_sorted":["cs.CV"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.RO","submitted_at":"2026-01-20T16:03:51Z","title_canon_sha256":"0954282a16ce738b881151c3bbe554046ed6c1689ad21950f917947bfe704bc3"},"schema_version":"1.0","source":{"id":"2601.14104","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2601.14104","created_at":"2026-05-18T03:10:11Z"},{"alias_kind":"arxiv_version","alias_value":"2601.14104v2","created_at":"2026-05-18T03:10:11Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2601.14104","created_at":"2026-05-18T03:10:11Z"},{"alias_kind":"pith_short_12","alias_value":"PNBRIR36RHL6","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_16","alias_value":"PNBRIR36RHL6GA5O","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_8","alias_value":"PNBRIR36","created_at":"2026-05-18T12:33:37Z"}],"graph_snapshots":[{"event_id":"sha256:018cad5d426d3ddc68b553c2a1cc99d3ab55778e668a31e7e7aa48aa50734b99","target":"graph","created_at":"2026-05-18T03:10:11Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":4,"items":[{"attestation":"unclaimed","claim_id":"C1","kind":"strongest_claim","source":"verdict.strongest_claim","status":"machine_extracted","text":"Experiments on a physical TurtleBot3 platform show that DGBA consistently outperforms prior RL backdoor attacks while preserving normal task performance."},{"attestation":"unclaimed","claim_id":"C2","kind":"weakest_assumption","source":"verdict.weakest_assumption","status":"machine_extracted","text":"That a conditional diffusion model can learn a stochastic trigger distribution maintaining consistent attack activation across varying uncontrollable auxiliary states such as LiDAR and odometry signals."},{"attestation":"unclaimed","claim_id":"C3","kind":"one_line_summary","source":"verdict.one_line_summary","status":"machine_extracted","text":"DGBA enables reliable backdoor attacks on real-world RL policies under partial observability by learning stochastic visual triggers via conditional diffusion and using advantage-based poisoning at critical states."},{"attestation":"unclaimed","claim_id":"C4","kind":"headline","source":"verdict.pith_extraction.headline","status":"machine_extracted","text":"A diffusion model learns visual triggers that activate backdoors in real robot RL policies despite varying uncontrollable sensors."}],"snapshot_sha256":"699e7da339654fc0ab037bf31973b387d4fa966d3de09e2cbd4e84f889dbc004"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Backdoor attacks can cause reinforcement learning (RL) policies to behave normally under clean inputs while executing malicious behaviors when triggers are present. Existing RL backdoor attacks are primarily studied in simulation and often assume that attackers can reliably manipulate the observations driving policy decisions. This assumption becomes fragile in real-world deployment, where RL policies commonly rely on multimodal observations. Attackers can manipulate visual inputs through physical triggers, but auxiliary states such as LiDAR and odometry signals remain uncontrollable and vary ","authors_text":"Haibo Hu, Jiawei Lian, Qingqing Ye, Tairan Huang, Yaxin Xiao, Yi Wang, Yulin Jin","cross_cats":["cs.CV"],"headline":"A diffusion model learns visual triggers that activate backdoors in real robot RL policies despite varying uncontrollable sensors.","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.RO","submitted_at":"2026-01-20T16:03:51Z","title":"When Backdoors Meet Partial Observability: Attacking Real-World Reinforcement Learning"},"references":{"count":30,"internal_anchors":3,"resolved_work":30,"sample":[{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":1,"title":"Turtlebot 3 as a robotics education platform","work_id":"84e1d42f-e4c9-4d3f-9a7c-38cf0582d596","year":2019},{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":2,"title":"Stepping locomotion for a walking excavator robot using hierarchical reinforcement learning and action masking","work_id":"3e010df0-710e-402e-8b18-16fca682a34c","year":2025},{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":3,"title":"Multi-agent inverse reinforcement learning in real world unstructured pedestrian crowds","work_id":"9c11e067-8e74-4cc4-83ab-36f67fe7f94e","year":2025},{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":4,"title":"Dames, and Mac Schwager","work_id":"09f13b62-06c5-4714-9ea9-a285226c9459","year":2025},{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":5,"title":"Choi, Fernando Casta˜neda, Won- suhk Jung, Bike Zhang, Claire J","work_id":"b92d056f-7baf-41ac-b0d8-c0e253ac3add","year":2025}],"snapshot_sha256":"55700e8ea09736bb9785c20010a62d9532101e1030a8a5ede88ea23abe6d2ce4"},"source":{"id":"2601.14104","kind":"arxiv","version":2},"verdict":{"created_at":"2026-05-16T12:35:43.305276Z","id":"0ef45a3b-8dbb-49f1-a88c-329e2c202dd0","model_set":{"reader":"grok-4.3"},"one_line_summary":"DGBA enables reliable backdoor attacks on real-world RL policies under partial observability by learning stochastic visual triggers via conditional diffusion and using advantage-based poisoning at critical states.","pipeline_version":"pith-pipeline@v0.9.0","pith_extraction_headline":"A diffusion model learns visual triggers that activate backdoors in real robot RL policies despite varying uncontrollable sensors.","strongest_claim":"Experiments on a physical TurtleBot3 platform show that DGBA consistently outperforms prior RL backdoor attacks while preserving normal task performance.","weakest_assumption":"That a conditional diffusion model can learn a stochastic trigger distribution maintaining consistent attack activation across varying uncontrollable auxiliary states such as LiDAR and odometry signals."}},"verdict_id":"0ef45a3b-8dbb-49f1-a88c-329e2c202dd0"}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:bee0d2a075af307197142c903de0aa2c4302670dd535472ad471b64a31c99748","target":"record","created_at":"2026-05-18T03:10:11Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"4d9470df52c6b4a960ff7def8fd624362b528cf40e11905e2892606ce5715442","cross_cats_sorted":["cs.CV"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.RO","submitted_at":"2026-01-20T16:03:51Z","title_canon_sha256":"0954282a16ce738b881151c3bbe554046ed6c1689ad21950f917947bfe704bc3"},"schema_version":"1.0","source":{"id":"2601.14104","kind":"arxiv","version":2}},"canonical_sha256":"7b4314477e89d7e303ae478a06a03ae9abde9c3890d0549d21f781616c2d8855","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"7b4314477e89d7e303ae478a06a03ae9abde9c3890d0549d21f781616c2d8855","first_computed_at":"2026-05-18T03:10:11.297322Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T03:10:11.297322Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"UiXKoBeXNxa+VkOXLR1wc1cw3vTstc/Ze533zGNYKFZrK6TxmZFdkzug54Okj4oMUZrmApQHXn62jASNqZwWDA==","signature_status":"signed_v1","signed_at":"2026-05-18T03:10:11.297895Z","signed_message":"canonical_sha256_bytes"},"source_id":"2601.14104","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:bee0d2a075af307197142c903de0aa2c4302670dd535472ad471b64a31c99748","sha256:018cad5d426d3ddc68b553c2a1cc99d3ab55778e668a31e7e7aa48aa50734b99"],"state_sha256":"1c80c887db9a5fa2b949322703386c6c23e38a42abff1d6c6501b525255a5098"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"HxpC+FTftheczewTFCd8mxJmZQ4lULbc4TOh1r4r/MP2jMSKvvI0DaM/8VHUkC6AwBWSZetk0pkpNKWJ5a1gDQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-02T07:56:15.364406Z","bundle_sha256":"a3081aa84f48126d9d5a3b2b67817e3c76146ecc385ba38705e2eb7afcfd8895"}}