GradFA: A Unified Gradient-Based Attribution Framework for Backdoor Detection and Mitigation in DRL-Based O-RAN xApps

Abstract

The Open Radio Access Network (O-RAN) xApp marketplace lets operators deploy third party deep reinforcement learning (DRL) applications into the Near-Real-Time RAN Intelligent Controller (Near-RT RIC), yet provides no way to verify the integrity of a submitted model. To tackle the problem, we propose GradFA (Gradient-based Feature Attribution), a pre-deployment integrity test for DRL xApps. Its primary two-tier screen uses only forward passes; for value-based models that clear both tiers, a conservative fallback checks agreement between the sweep-localized action and an input-gradient direction anomaly. Requiring no training data, trusted reference, or per-model optimization, GradFA exploits a structural property of clean policies: their value landscape stays flat under bounded input perturbation, whereas replay-buffer poisoning leaves a sharp, localized spike at the triggered feature group that no clean model exhibits. Across five DRL families and three xApp tasks, a separate clean-only calibration/held-out protocol detects 118/118 trojans and flags 1/39 held-out clean models. A Q-gap-minimizing attacker with 100% attack success evades both primary tiers; the conditional guard detects all 10 repeats, but a transfer audit flags 1/93 clean models, requiring family-specific calibration. Additional audits cover deeper feed-forward, recurrent, and centralized two-cell policies, as well as foreign channel rollouts. The screen runs in under one second per model. Both tested repairs suppress the target action, although service utility is only partially recovered. These findings are empirical, apply to the evaluated model families and calibration coverage, and do not establish an architecture- or attack-independent guarantee.