mlsanityData to 7 Oct 2026

Policy Poisoning in Batch Reinforcement Learning and Control

arXiv 1910.05821 ↗First posted 13 Oct 2019cs.LG stat.MLcited by 70

On the map: Offline RL and imitation learning from data → Offline RL algorithms

Abstract (arXiv)

We study a security threat to batch reinforcement learning and control where the attacker aims to poison the learned policy. The victim is a reinforcement learner / controller which first estimates the dynamics and the rewards from a batch data set, and then solves for the optimal policy with respect to the estimates. The attacker can modify the data set slightly before learning happens, and wants to force the learner into learning a target policy chosen by the attacker. We present a unified framework for solving batch policy poisoning attacks, and instantiate the attack on two standard victims: tabular certainty equivalence learner in reinforcement learning and linear quadratic regulator in control. We show that both instantiation result in a convex optimization problem on which global optimality is guaranteed, and provide analysis on attack feasibility and attack cost. Experiments show the effectiveness of policy poisoning attacks.

Key facts. Cited by 70 papers in the map (data through 7 Oct 2026). Placed in Offline RL algorithms, one of 13 directions in Offline RL and imitation learning from data. Builds on 13 of its 23 references that are in the map. First posted on arXiv 13 Oct 2019.

Builds on

13 of 23 references.

References · 13

  1. 2016CVXPY: A Python-Embedded Modeling Language for Convex Optimizationcited by 633
  2. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  3. 2017Adversarial Attacks on Neural Network Policiescited by 314
  4. 2017On the Sample Complexity of the Linear Quadratic Regulatorcited by 151
  5. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
  6. 2018Is feature selection secure against training data poisoning?cited by 88
  7. 2016Data Poisoning Attacks on Factorization-Based Collaborative Filteringcited by 78
  8. 2018Adversarial Attacks on Stochastic Banditscited by 56
  9. 2019Data Poisoning Attacks on Stochastic Banditscited by 52
  10. 2018Machine Teaching for Inverse Reinforcement Learning: Algorithms and Applicationscited by 28
  11. 2018Data Poisoning Attacks against Online Learningcited by 24
  12. 2019Interactive Teaching Algorithms for Inverse Reinforcement Learningcited by 24
1 more
  1. 2018Data Poisoning Attacks in Contextual Banditscited by 22

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2020: 1; 2021: 15; 2022: 13; 2023: 12; 2024: 15; 2025: 11; 2026: 3.

70 papers.

Sort:

By area:

  1. 2021Robust Reinforcement Learning on State Observations with Learned Optimal Adversarycited by 133
  2. 2022RORL: Robust Offline Reinforcement Learning via Conservative Smoothingcited by 83
  3. 2022Trustworthy Reinforcement Learning Against Intrinsic Vulnerabilities: Robustness, Safety, and Generalizabilitycited by 32
  4. 2023RLHFPoison: Reward Poisoning Attack for Reinforcement Learning with Human Feedback in Large Language Modelscited by 32
  5. 2021Robust Policy Gradient against Strong Data Corruptioncited by 30
  6. 2023Corruption-Robust Offline Reinforcement Learning with General Function Approximationcited by 30
  7. 2021Provably Efficient Black-Box Action Poisoning Attacks Against Reinforcement Learningcited by 29
  8. 2021Reward Poisoning in Reinforcement Learning: Attacks Against Unknown Learners in Unknown Environmentscited by 26
  9. 2022COPA: Certifying Robust Policies for Offline Reinforcement Learning against Poisoning Attackscited by 25
  10. 2022Understanding the Limits of Poisoning Attacks in Episodic Reinforcement Learningcited by 21
  11. 2021Defense Against Reward Poisoning Attacks in Reinforcement Learningcited by 20
  12. 2022Reward Poisoning Attacks on Offline Multi-Agent Reinforcement Learningcited by 19
38 more
  1. 2021Reinforcement Learning for Feedback-Enabled Cyber Resiliencecited by 18
  2. 2021Adversarial attacks in consensus-based multi-agent reinforcement learningcited by 17
  3. 2021Poisoning Attack against Estimating from Pairwise Comparisonscited by 14
  4. 2023Implicit Poisoning Attacks in Two-Agent Reinforcement Learning: Adversarial Policies for Training-Time Attackscited by 14
  5. 2021Multi-Task Federated Reinforcement Learning with Adversariescited by 13
  6. 2022Byzantine-Robust Online and Offline Distributed Reinforcement Learningcited by 13
  7. 2024Nonparametric Teaching of Implicit Neural Representationscited by 13
  8. 2022Admissible Policy Teaching through Reward Designcited by 12
  9. 2021Fair Clustering Using Antidote Datacited by 10
  10. 2021Iterative Teaching by Label Synthesiscited by 10
  11. 2021SoK: Machine Learning Governancecited by 9
  12. 2022Efficient Reward Poisoning Attacks on Online Deep Reinforcement Learningcited by 9
  13. 2023Nonparametric Iterative Machine Teachingcited by 9
  14. 2023Efficient Adversarial Attacks on Online Multi-agent Reinforcement Learningcited by 9
  15. 2021Game Redesign in No-regret Game Playingcited by 8
  16. 2022Iterative Teaching by Data Hallucinationcited by 8
  17. 2024Uncertainty-based Offline Variational Bayesian Reinforcement Learning for Robustness under Diverse Data Corruptionscited by 8
  18. 2023Nonparametric Teaching for Multiple Learnerscited by 7
  19. 2024SUB-PLAY: Adversarial Policies against Partially Observed Multi-Agent Reinforcement Learning Systemscited by 7
  20. 2024TrajDeleter: Enabling Trajectory Forgetting in Offline Reinforcement Learning Agentscited by 7
  21. 2023Adversarial Attacks on Adversarial Banditscited by 6
  22. 2022Sampling Attacks on Meta Reinforcement Learning: A Minimax Formulation and Complexity Analysiscited by 5
  23. 2025Nonparametric Teaching for Graph Property Learnerscited by 5
  24. 2025Fox in the Henhouse: Supply-Chain Backdoor Attacks Against Reinforcement Learningcited by 5
  25. 2021Disturbing Reinforcement Learning Agents with Corrupted Rewardscited by 4
  26. 2024Assessing the Impact of Distribution Shift on Reinforcement Learning Performancecited by 4
  27. 2024Universal Black-Box Reward Poisoning Attack against Offline Reinforcement Learningcited by 4
  28. 2024Corruption-Robust Offline Two-Player Zero-Sum Markov Gamescited by 4
  29. 2024Data Poisoning Attacks on Off-Policy Policy Evaluation Methodscited by 4
  30. 2021Efficient Action Poisoning Attacks on Linear Contextual Banditscited by 3
  31. 2024Informativeness of Reward Functions in Reinforcement Learningcited by 3
  32. 2024Testing autonomous vehicles and AI: perspectives and challenges from cybersecurity, transparency, robustness and fairnesscited by 3
  33. 2022Imitating Opponent to Win: Adversarial Policy Imitation Learning in Two-player Competitive Gamescited by 2
  34. 2023Minimally Modifying a Markov Game to Achieve Any Nash Equilibrium and Valuecited by 2
  35. 2024Stealthy Adversarial Attacks on Stochastic Multi-Armed Banditscited by 2
  36. 2024Online Poisoning Attack Against Reinforcement Learning under Black-box Environmentscited by 2
  37. 2025Policy Teaching via Data Poisoning in Learning from Human Preferencescited by 2
  38. 2025TrojanTO: Action-Level Backdoor Attacks against Trajectory Optimization Modelscited by 2

50 most cited of 70 All 70 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Multi-level Certified Defense Against Poisoning Attacks in Offline Reinforcement Learning
  2. 2024Correlated Proxies: A New Definition and Improved Mitigation for Reward Hacking
  3. 2026Sequential Data Poisoning in LLM Post-Training
  4. 2020Provably Good Batch Reinforcement Learning Without Great Exploration
  5. 2024Is poisoning a real threat to LLM alignment? Maybe more so than you think
  6. 2021Continuous Doubly Constrained Batch Reinforcement Learning
  7. 2020BRPO: Batch Residual Policy Optimization
  8. 2025Dataset Poisoning Attacks on Behavioral Cloning Policies