mlsanityData to 13 Oct 2026

Understanding the Limits of Poisoning Attacks in Episodic Reinforcement Learning

arXiv 2208.13663 ↗First posted 29 Aug 2022cs.LG cs.CR stat.MLcited by 21

Not on the map. Why?

Abstract (arXiv)

To understand the security threats to reinforcement learning (RL) algorithms, this paper studies poisoning attacks to manipulate any order-optimal learning algorithm towards a targeted policy in episodic RL and examines the potential damage of two natural types of poisoning attacks, i.e., the manipulation of reward and action. We discover that the effect of attacks crucially depend on whether the rewards are bounded or unbounded. In bounded reward settings, we show that only reward manipulation or only action manipulation cannot guarantee a successful attack. However, by combining reward and action manipulation, the adversary can manipulate any order-optimal learning algorithm to follow any targeted policy with tildeTheta(√T) total attack cost, which is order-optimal, without any knowledge of the underlying MDP. In contrast, in unbounded reward settings, we show that reward manipulation attacks are sufficient for an adversary to successfully manipulate any order-optimal learning algorithm to follow any targeted policy using tildeO(√T) amount of contamination. Our results reveal useful insights about what can or cannot be achieved by poisoning attacks, and are set to spur more works on the design of robust RL algorithms.

Key facts. Cited by 21 papers in the map (data through 13 Oct 2026). Builds on 24 of its 34 references that are in the map. First posted on arXiv 29 Aug 2022.

Builds on

24 of 34 references.

References · 24

  1. 2018Is Q-learning Provably Efficient?cited by 485
  2. 2017Adversarial Attacks on Neural Network Policiescited by 316
  3. 2017Tactics of Adversarial Attack on Deep Reinforcement Learning Agentscited by 165
  4. 2013Bandits with Knapsackscited by 163
  5. 2017Delving into adversarial attacks on deep policiescited by 104
  6. 2018Deep Reinforcement Learning for Page-wise Recommendationscited by 99
  7. 2017Vulnerability of Deep Reinforcement Learning to Policy Induction Attackscited by 91
  8. 2020Adaptive Reward-Poisoning Attacks against Reinforcement Learningcited by 86
  9. 2020Policy Teaching via Environment Poisoning: Training-time Adversarial Attacks against Reinforcement Learningcited by 81
  10. 2019Data Poisoning against Differentially-Private Learners: Attacks and Defensescited by 78
  11. 2019Policy Poisoning in Batch Reinforcement Learning and Controlcited by 70
  12. 2020Stochastic Linear Bandits Robust to Adversarial Attackscited by 65
12 more
  1. 2018Adversarial Attacks on Stochastic Banditscited by 56
  2. 2019Data Poisoning Attacks on Stochastic Banditscited by 53
  3. 2016Towards End-to-End Reinforcement Learning of Dialogue Agents for Information Accesscited by 36
  4. 2021Reward Poisoning in Reinforcement Learning: Attacks Against Unknown Learners in Unknown Environmentscited by 26
  5. 2021Improved Corruption Robust Algorithms for Episodic Reinforcement Learningcited by 20
  6. 2021Nearly Minimax Optimal Regret for Learning Infinite-horizon Average-reward MDPs with Linear Function Approximationcited by 18
  7. 2021Saving Stochastic Bandits from Poisoning Attacks via Limited Data Verificationcited by 9
  8. 2018Online learning with feedback graphs and switching costscited by 8
  9. 2020Action-Manipulation Attacks Against Stochastic Bandits: Attacks and Defensecited by 8
  10. 2020Learning-based attacks in Cyber-Physical Systems: Exploration, Detection, and Control Cost trade-offscited by 5
  11. 2020Manipulating Reinforcement Learning: Poisoning Attacks on Cost Signalscited by 3
  12. 2020Reinforcement Learning for Unified Allocation and Patrolling in Signaling Games with Uncertaintycited by 2

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2023: 6; 2024: 7; 2025: 5; 2026: 3.

21 papers.

Sort:

By area:

  1. 2024SleeperNets: Universal Backdoor Poisoning Attacks Against Reinforcement Learning Agentscited by 19
  2. 2023Implicit Poisoning Attacks in Two-Agent Reinforcement Learning: Adversarial Policies for Training-Time Attackscited by 14
  3. 2023Optimal Attack and Defense for Reinforcement Learningcited by 12
  4. 2023Efficient Adversarial Attacks on Online Multi-agent Reinforcement Learningcited by 9
  5. 2024Artwork Protection Against Neural Style Transfer Using Locally Adaptive Adversarial Color Attackcited by 9
  6. 2024Adversarial Inception Backdoor Attacks against Reinforcement Learningcited by 8
  7. 2025Fox in the Henhouse: Supply-Chain Backdoor Attacks Against Reinforcement Learningcited by 5
  8. 2024Adversarially Robust Decision Transformercited by 4
  9. 2023Adversarial Attacks on Combinatorial Multi-Armed Banditscited by 2
  10. 2023Minimally Modifying a Markov Game to Achieve Any Nash Equilibrium and Valuecited by 2
  11. 2024Robust Deep Reinforcement Learning against Adversarial Behavior Manipulationcited by 2
  12. 2024Online Poisoning Attack Against Reinforcement Learning under Black-box Environmentscited by 2
9 more
  1. 2025Policy Teaching via Data Poisoning in Learning from Human Preferencescited by 2
  2. 2023Data Poisoning to Fake a Nash Equilibrium in Markov Gamescited by 1
  3. 2024Inception: Efficiently Computable Misinformation Attacks on Markov Gamescited by 1
  4. 2025Optimally Installing Strict Equilibriacited by 0
  5. 2025Robust In-Context Reinforcement Learning Under Reward Poisoning Attackscited by 0
  6. 2025Collapsing Sequence-Level Data-Policy Coverage via Poisoning Attack in Offline Reinforcement Learningcited by 0
  7. 2026Corruption-robust Offline Multi-agent Reinforcement Learning From Human Feedbackcited by 0
  8. 2026When Can You Poison Rewards? A Tight Characterization of Reward Poisoning in Linear MDPscited by 0
  9. 2026Efficient Preference Poisoning Attack on Offline RLHFcited by 0