mlsanityData to 7 Oct 2026

CROP: Certifying Robust Policies for Reinforcement Learning through Functional Smoothing

arXiv 2106.09292 ↗First posted 17 Jun 2021cs.LGcited by 41

Not on the map. Why?

Abstract (arXiv)

As reinforcement learning (RL) has achieved great success and been even adopted in safety-critical domains such as autonomous vehicles, a range of empirical studies have been conducted to improve its robustness against adversarial attacks. However, how to certify its robustness with theoretical guarantees still remains challenging. In this paper, we present the first unified framework CROP (Certifying Robust Policies for RL) to provide robustness certification on both action and reward levels. In particular, we propose two robustness certification criteria: robustness of per-state actions and lower bound of cumulative rewards. We then develop a local smoothing algorithm for policies derived from Q-functions to guarantee the robustness of actions taken along the trajectory; we also develop a global smoothing algorithm for certifying the lower bound of a finite-horizon cumulative reward, as well as a novel local smoothing algorithm to perform adaptive search in order to obtain tighter reward certification. Empirically, we apply CROP to evaluate several existing empirically robust RL algorithms, including adversarial training and different robust regularization, in four environments (two representative Atari games, Highway, and CartPole). Furthermore, by evaluating these algorithms against adversarial attacks, we demonstrate that our certification are often tight. All experiment results are available at website https://crop-leaderboard.github.io.

Key facts. Cited by 41 papers in the map (data through 7 Oct 2026). Builds on 55 of its 90 references that are in the map. First posted on arXiv 17 Jun 2021.

Builds on

55 of 90 references.

References · 55

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2013Playing Atari with Deep Reinforcement Learningcited by 3,211
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2015Deep Reinforcement Learning with Double Q-learningcited by 1,704
  6. 2017Domain Randomization for Transferring Deep Neural Networks from Simulation to the Real Worldcited by 1,401
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  8. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  9. 2015Prioritized Experience Replaycited by 1,070
  10. 2016Adversarial Machine Learning at Scalecited by 934
  11. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
  12. 2019Solving Rubik's Cube with a Robot Handcited by 699
38 more
  1. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 568
  2. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  3. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  4. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 439
  5. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  6. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  7. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
  8. 2017Adversarial Attacks on Neural Network Policiescited by 314
  9. 2018Certified Defenses against Adversarial Examplescited by 305
  10. 2016Safe, Multi-Agent, Reinforcement Learning for Autonomous Drivingcited by 301
  11. 2017Noisy Networks for Explorationcited by 262
  12. 2019End-to-End Safe Reinforcement Learning through Barrier Functions for Safety-Critical Continuous Control Taskscited by 256
  13. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
  14. 2017Formal Verification of Piece-Wise Linear Feed-Forward Neural Networkscited by 241
  15. 2020Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observationscited by 235
  16. 2017Deep Reinforcement Learning framework for Autonomous Drivingcited by 224
  17. 2019Adversarial Policies: Attacking Deep Reinforcement Learningcited by 209
  18. 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
  19. 2021Maximum Entropy RL (Provably) Solves Some Robust RL Problemscited by 169
  20. 2017Tactics of Adversarial Attack on Deep Reinforcement Learning Agentscited by 163
  21. 2017Robust Deep Reinforcement Learning with Adversarial Attackscited by 152
  22. 2017A General Safety Framework for Learning-Based Control in Uncertain Robotic Systemscited by 150
  23. 2020Randomized Smoothing of All Shapes and Sizescited by 146
  24. 2021Robust Reinforcement Learning on State Observations with Learned Optimal Adversarycited by 133
  25. 2017Delving into adversarial attacks on deep policiescited by 104
  26. 2017Maximum Resilience of Artificial Neural Networkscited by 97
  27. 2017Vulnerability of Deep Reinforcement Learning to Policy Induction Attackscited by 91
  28. 2020Consistency Regularization for Certified Robustness of Smoothed Classifierscited by 73
  29. 2020Robust Deep Reinforcement Learning through Adversarial Losscited by 73
  30. 2019Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifierscited by 65
  31. 2020Reinforcement-Learning based Portfolio Management with Augmented Asset Movement Prediction Statescited by 55
  32. 2021Who Is the Strongest Enemy? Towards Optimal and Efficient Evasion Attacks in Deep RLcited by 54
  33. 2016Transfer from Simulation to Real World through Learning Deep Inverse Dynamics Modelcited by 53
  34. 2020Detection as Regression: Certified Object Detection by Median Smoothingcited by 47
  35. 2020Enforcing robust control guarantees within neural network policiescited by 40
  36. 2020Certifying Confidence via Randomized Smoothingcited by 36
  37. 2017Whatever Does Not Kill Deep Reinforcement Learning, Makes It Strongercited by 35
  38. 2019Online Robustness Training for Deep Reinforcement Learningcited by 26

50 most cited of 55 All 55 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 14; 2023: 14; 2024: 7; 2025: 4; 2026: 2.

41 papers.

Sort:

By area:

  1. 2023Certifying LLM Safety against Adversarial Promptingcited by 248
  2. 2022Efficient Adversarial Training without Attacking: Worst-Case-Aware Robust Reinforcement Learningcited by 42
  3. 2022Trustworthy Reinforcement Learning Against Intrinsic Vulnerabilities: Robustness, Safety, and Generalizabilitycited by 32
  4. 2022COPA: Certifying Robust Policies for Offline Reinforcement Learning against Poisoning Attackscited by 25
  5. 2022Robust Deep Reinforcement Learning through Bootstrapped Opportunistic Curriculumcited by 15
  6. 2023Implicit Poisoning Attacks in Two-Agent Reinforcement Learning: Adversarial Policies for Training-Time Attackscited by 14
  7. 2022Illusory Attacks: Information-Theoretic Detectability Matters in Adversarial Attackscited by 12
  8. 2023Optimal Attack and Defense for Reinforcement Learningcited by 12
  9. 2022Confidence-aware Training of Smoothed Classifiers for Certified Robustnesscited by 9
  10. 2024COLEP: Certifiably Robust Learning-Reasoning Conformal Prediction via Probabilistic Circuitscited by 9
  11. 2022Certifiably Robust Policy Learning against Adversarial Communication in Multi-agent Systemscited by 7
  12. 2022Certified Policy Smoothing for Cooperative Multi-Agent Reinforcement Learningcited by 7
29 more
  1. 2023Rethinking Adversarial Policies: A Generalized Attack Formulation and Provable Defense in RLcited by 7
  2. 2023Improve Robustness of Reinforcement Learning against Observation Perturbations via l_∞ Lipschitz Policy Networkscited by 7
  3. 2023Reward Certification for Policy Smoothed Reinforcement Learningcited by 6
  4. 2022Certifying Model Accuracy under Distribution Shiftscited by 5
  5. 2024Corruption-Robust Offline Two-Player Zero-Sum Markov Gamescited by 4
  6. 2024On Robust Reinforcement Learning with Lipschitz-Bounded Policy Networkscited by 4
  7. 2024Breaking the Barrier: Enhanced Utility and Robustness in Smoothed DRL Agentscited by 4
  8. 2022FI-ODE: Certifiably Robust Forward Invariance in Neural ODEscited by 3
  9. 2023SoK: Adversarial Machine Learning Attacks and Defences in Multi-Agent Reinforcement Learningcited by 3
  10. 2023Toward Evaluating Robustness of Reinforcement Learning with Adversarial Policycited by 3
  11. 2023Robust Multi-agent Communication via Multi-view Message Certificationcited by 3
  12. 2023Certifiably Robust Reinforcement Learning through Model-Based Abstract Interpretationcited by 2
  13. 2023Mixing Classifiers to Alleviate the Accuracy-Robustness Trade-Offcited by 2
  14. 2024Robust Deep Reinforcement Learning against Adversarial Behavior Manipulationcited by 2
  15. 2026Diagnosing JEPA World Models with Action-Conditioned Predictive Consistencycited by 2
  16. 2022An Overview and Prospective Outlook on Robust Training and Certification of Machine Learning Modelscited by 1
  17. 2022Chaos Theory and Adversarial Robustnesscited by 1
  18. 2022Security of Deep Reinforcement Learning for Autonomous Driving: A Surveycited by 1
  19. 2023Provable Robustness for Streaming Models with a Sliding Windowcited by 1
  20. 2024Exact Recovery Guarantees for Parameterized Nonlinear System Identification Problem under Sparse Disturbances or Semi-Oblivious Attackscited by 1
  21. 2025CAMP in the Odyssey: Provably Robust Reinforcement Learning with Certified Radius Maximizationcited by 1
  22. 2025Action Robust Reinforcement Learning via Optimal Adversary Aware Policy Optimizationcited by 1
  23. 2022Certifying Safety in Reinforcement Learning under Adversarial Perturbation Attackscited by 0
  24. 2023Game-Theoretic Robust Reinforcement Learning Handles Temporally-Coupled Perturbationscited by 0
  25. 2023Robust Offline Reinforcement Learning -- Certify the Confidence Intervalcited by 0
  26. 2024Training Verifiably Robust Agents Using Set-Based Reinforcement Learningcited by 0
  27. 2025Density-Ratio Weighted Behavioral Cloning: Learning Control Policies from Corrupted Datasetscited by 0
  28. 2025On the Tension Between Optimality and Adversarial Robustness in Policy Optimizationcited by 0
  29. 2026Certifying Lower Bounds for Risk-Sensitive Reinforcement Learning under Adversarial State Perturbationscited by 0