Beyond the Model: Safeguarding the AI Supply Chain in UK Public Infrastructure

1. Introduction: The "Trusting Trust" Crisis

In his seminal 1984 Turing Award lecture, Reflections on Trusting Trust, Ken Thompson revealed that "you can't trust code that you did not totally create yourself," demonstrating how a compiler could be backdoored to insert malicious code into every program it compiled(Thompson, 1984)Source Excerpt: "To what extent should one trust a statement that a program is free of Trojan horses? Perhaps it is more important to trust the people who wrote the software." - Thompson (1984).. This fundamental dilemma has now migrated to the AI supply chain.

While attention has historically focused on "data poisoning," recent technical breakthroughs prove that the underlying components of the learning process—the tools and wrappers used to build AI—can be compromised(Vyas et al., 2026)Source Excerpt: "We reveal critical vulnerabilities across the DRL supply chain... TrojanentRL exploits component-level flaws to implant a persistent backdoor that survives full model retraining." - Vyas et al. (2026)..

2. Compromise of Safety-Critical Domains

Deep Reinforcement Learning (DRL) is no longer theoretical; it is currently delivering critical capabilities in high-stakes UK infrastructure. A successful backdoor attack in these sectors could lead to catastrophic physical or digital failures(Vyas et al., 2026)Source Insight: DRL is used in safety-sensitive domains including autonomous vehicles, nuclear fusion, and cyber defence. Compromised agents risk severe consequences.:

• Nuclear Fusion Control: DRL is utilised for the magnetic control of tokamak plasmas(Degrave et al., 2022)Context: DRL agents control the magnetic coils of nuclear fusion reactors. A backdoored agent could be triggered to destabilise the plasma, causing structural damage or reactor shutdown.. A backdoored agent could be triggered to destabilise the reactor.
• Cyber Defence: Autonomous agents are employed in cyber network defence(Vyas, Mavroudis and Burnap, 2025)Context: Autonomous agents defend networks against real-time intrusions. A dormant backdoor allows adversaries to present a trigger that forces the agent to 'ignore' a malicious packet.. A dormant backdoor could allow adversaries to bypass automated security protocols during a cyberattack.
• Autonomous Vehicles: DRL drives autonomous systems in urban environments(Fayjie et al., 2018)Context: DRL policies handle navigation and object avoidance. A poisoned weight can be activated by a specific pixel pattern on a road sign, inducing collisions.. Compromised agents could be triggered to cause collisions or traffic disruptions.

3. Exploitation of the Software Supply Chain

National security entities often rely on open-source code to accelerate development. These attacks exploit this reliance, bypassing traditional perimeters:

3.1. Component-Level Compromise (TrojanentRL)

Adversaries can infect auxiliary software components, such as a "tiny colour-enhancing tool" used in image preprocessing or a "rollout buffer" in public repositories. If a contractor uses these compromised libraries, the backdoor is injected during the 'Build' phase, effectively poisoning the model even if it is trained on secure, classified data(Vyas et al., 2026)TrojanentRL Logic: The backdoor is not in the training data; it is in the tool used to train. It guidances policy learning toward a controlled malicious behaviour..

3.2. Model Sourcing Risks (InfrectroRL)

Agencies often download pretrained models to save computational costs. InfrectroRL allows adversaries to inject backdoors into these models post-training. This requires zero access to the victim's training pipeline, allowing attackers to compromise distributed models remotely(Vyas et al., 2026)InfrectroRL Logic: Targeted optimisation of pre-trained model parameters. Requires GPU minutes vs. days of training. Data-free modification..

4. Strategic Failure of Existing Defences

The most critical security implication is the failure of current detection methods. Empirical evidence demonstrates that InfrectroRL successfully evades state-of-the-art DRL backdoor defences, specifically BIRD(Chen et al., 2023)BIRD: Generalisable Backdoor Detection and Removal. Relies on data-based trigger detection; InfrectroRL evades this as it does not poison the training distribution.and SHINE(Yuan et al., 2024)SHINE: Shielding backdoors in DRL. Fails against post-training weight modification which does not rely on training-time anomalies..

These attacks function as "Sleeper Agents," maintaining high performance on clean data (Clean Data Accuracy) while waiting for a specific trigger. In a national security context, this ensures the compromised system passes all standard validation protocols, only executing the malicious action during a specific geopolitical event or cyber-strike.