mlsanityData to 7 Oct 2026

Provably Efficient Black-Box Action Poisoning Attacks Against Reinforcement Learning

arXiv 2110.04471 ↗First posted 9 Oct 2021cs.LG cs.AI cs.CRcited by 29

Not on the map. Why?

Abstract (arXiv)

Due to the broad range of applications of reinforcement learning (RL), understanding the effects of adversarial attacks against RL model is essential for the safe applications of this model. Prior theoretical works on adversarial attacks against RL mainly focus on either observation poisoning attacks or environment poisoning attacks. In this paper, we introduce a new class of attacks named action poisoning attacks, where an adversary can change the action signal selected by the agent. Compared with existing attack models, the attacker's ability in the proposed action poisoning attack model is more restricted, which brings some design challenges. We study the action poisoning attack in both white-box and black-box settings. We introduce an adaptive attack scheme called LCB-H, which works for most RL agents in the black-box setting. We prove that the LCB-H attack can force any efficient RL agent, whose dynamic regret scales sublinearly with the total number of steps taken, to choose actions according to a policy selected by the attacker very frequently, with only sublinear cost. In addition, we apply LCB-H attack against a popular model-free RL algorithm: UCB-H. We show that, even in the black-box setting, by spending only logarithm cost, the proposed LCB-H attack scheme can force the UCB-H agent to choose actions according to the policy selected by the attacker very frequently.

Key facts. Cited by 29 papers in the map (data through 7 Oct 2026). Builds on 38 of its 50 references that are in the map. First posted on arXiv 9 Oct 2021.

Builds on

38 of 50 references.

References · 38

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2013Intriguing properties of neural networkscited by 5,114
  3. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  4. 2016Adversarial Machine Learning at Scalecited by 934
  5. 2016Universal adversarial perturbationscited by 774
  6. 2017Minimax Regret Bounds for Reinforcement Learningcited by 500
  7. 2018Is Q-learning Provably Efficient?cited by 485
  8. 2017Robust Adversarial Reinforcement Learningcited by 439
  9. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  10. 2018Reinforcement Learning for Solving the Vehicle Routing Problemcited by 327
  11. 2017Adversarial Attacks on Neural Network Policiescited by 314
  12. 2017Tactics of Adversarial Attack on Deep Reinforcement Learning Agentscited by 163
26 more
  1. 2019Are Labels Required for Improving Adversarial Robustness?cited by 162
  2. 2017Delving into adversarial attacks on deep policiescited by 104
  3. 2018Deep Reinforcement Learning for Page-wise Recommendationscited by 99
  4. 2017Vulnerability of Deep Reinforcement Learning to Policy Induction Attackscited by 91
  5. 2020Adaptive Reward-Poisoning Attacks against Reinforcement Learningcited by 86
  6. 2020FinRL: A Deep Reinforcement Learning Library for Automated Stock Trading in Quantitative Financecited by 86
  7. 2020Policy Teaching via Environment Poisoning: Training-time Adversarial Attacks against Reinforcement Learningcited by 81
  8. 2020Logarithmic Regret for Reinforcement Learning with Linear Function Approximationcited by 79
  9. 2018Scalable End-to-End Autonomous Vehicle Testing via Rare-event Simulationcited by 76
  10. 2019Interpreting Adversarially Trained Convolutional Neural Networkscited by 75
  11. 2020Reinforcement Learning for Non-Stationary Markov Decision Processes: The Blessing of (More) Optimismcited by 75
  12. 2019Policy Poisoning in Batch Reinforcement Learning and Controlcited by 70
  13. 2020Q-learning with Logarithmic Regretcited by 59
  14. 2018Adversarial Attacks on Stochastic Banditscited by 56
  15. 2019Data Poisoning Attacks on Stochastic Banditscited by 52
  16. 2019Deceptive Reinforcement Learning Under Adversarial Manipulations on Cost Signalscited by 50
  17. 2020Vulnerability-Aware Poisoning Mechanism for Online RL with Unknown Dynamicscited by 38
  18. 2017Analyzing the Robustness of Nearest Neighbors to Adversarial Examplescited by 36
  19. 2019Theoretical evidence for adversarial robustness through randomizationcited by 33
  20. 2020Dynamic Regret of Policy Optimization in Non-stationary Environmentscited by 32
  21. 2021Reward Poisoning in Reinforcement Learning: Attacks Against Unknown Learners in Unknown Environmentscited by 26
  22. 2019Spatiotemporally Constrained Action Space Attacks on Deep Reinforcement Learning Agentscited by 24
  23. 2020Policy Teaching in Reinforcement Learning via Environment Poisoning Attackscited by 24
  24. 2020Robust Stochastic Bandit Algorithms under Probabilistic Unbounded Adversarial Attackcited by 13
  25. 2020Action-Manipulation Attacks Against Stochastic Bandits: Attacks and Defensecited by 8
  26. 2020On the Adversarial Robustness of LASSO Based Feature Selectioncited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 2; 2022: 4; 2023: 8; 2024: 5; 2025: 5; 2026: 5.

29 papers.

Sort:

By area:

  1. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agentscited by 135
  2. 2023BadRL: Sparse Targeted Backdoor Attack Against Reinforcement Learningcited by 29
  3. 2022Reward Poisoning Attacks on Offline Multi-Agent Reinforcement Learningcited by 19
  4. 2023Implicit Poisoning Attacks in Two-Agent Reinforcement Learning: Adversarial Policies for Training-Time Attackscited by 14
  5. 2023Optimal Attack and Defense for Reinforcement Learningcited by 12
  6. 2021When Are Linear Stochastic Bandits Attackable?cited by 10
  7. 2022Efficient Reward Poisoning Attacks on Online Deep Reinforcement Learningcited by 9
  8. 2023Efficient Adversarial Attacks on Online Multi-agent Reinforcement Learningcited by 9
  9. 2023Adversarial Attacks on Adversarial Banditscited by 6
  10. 2025Fox in the Henhouse: Supply-Chain Backdoor Attacks Against Reinforcement Learningcited by 5
  11. 2021Efficient Action Poisoning Attacks on Linear Contextual Banditscited by 3
  12. 2025Advancing Robustness in Deep Reinforcement Learning with an Ensemble Defense Approachcited by 3
17 more
  1. 2025Collaborative Shadows: Distributed Backdoor Attacks in LLM-Based Multi-Agent Systemscited by 3
  2. 2023Efficient Action Robust Reinforcement Learning with Probabilistic Policy Execution Uncertaintycited by 2
  3. 2024Stealthy Adversarial Attacks on Stochastic Multi-Armed Banditscited by 2
  4. 2024Online Poisoning Attack Against Reinforcement Learning under Black-box Environmentscited by 2
  5. 2022Reinforcement Learning for Linear Quadratic Control is Vulnerable Under Cost Manipulationcited by 1
  6. 2022Security of Deep Reinforcement Learning for Autonomous Driving: A Surveycited by 1
  7. 2023Data Poisoning to Fake a Nash Equilibrium in Markov Gamescited by 1
  8. 2023Optimal Cost Constrained Adversarial Attacks For Multiple Agent Systemscited by 1
  9. 2024Provably Efficient Action-Manipulation Attack Against Continuous Reinforcement Learningcited by 1
  10. 2025Action Robust Reinforcement Learning via Optimal Adversary Aware Policy Optimizationcited by 1
  11. 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
  12. 2024Privacy and Security Implications of Cloud-Based AI Services : A Surveycited by 0
  13. 2025Provably Invincible Adversarial Attacks on Reinforcement Learning Systems: A Rate-Distortion Information-Theoretic Approachcited by 0
  14. 2026When Can You Poison Rewards? A Tight Characterization of Reward Poisoning in Linear MDPscited by 0
  15. 2026Efficient Preference Poisoning Attack on Offline RLHFcited by 0
  16. 2026Safe-RULE: Safe Reinforcement UnLEarningcited by 0
  17. 2026Robust Policy Optimization via Adversarial Importance Samplingcited by 0