mlsanityData to 7 Oct 2026

How Vulnerable Is My Learned Policy? Universal Adversarial Perturbation Attacks On Modern Behavior Cloning Policies

arXiv 2502.03698 ↗First posted 6 Feb 2025cs.LG cs.CR cs.ROcited by 2

On the map: Offline RL and imitation learning from data → Imitation learning methods

Abstract (arXiv)

Imitation learning, also known as learning from demonstrations, is a popular approach to train AI models; however, the vulnerability of these models to adversarial attacks remains underexplored. We present the first systematic study of adversarial attacks, across a range of both classic and recently proposed imitation learning algorithms, including Vanilla Behavior Cloning (Vanilla BC), LSTM-GMM, Implicit Behavior Cloning (IBC), Diffusion Policy (DP), and Vector-Quantized Behavior Transformer (VQ-BET). We study the vulnerability of these methods to white-box, grey-box and black-box adversarial perturbations. Our experiments reveal that most existing methods are highly vulnerable to these attacks, including black-box transfer attacks that transfer across algorithms. White-box attacks cause at least a 65% reduction in average task success across all evaluated tasks and algorithms, while the black-box transfer attacks reduce task success by up to 88% on Lift, 99% on Can, and 100% on Square. To the best of our knowledge, we are the first to study and compare the vulnerabilities of different popular imitation learning algorithms to both white-box and black-box attacks. Our findings highlight the vulnerabilities of modern imitation learning algorithms, paving the way for future work in addressing such limitations. Videos and code are available at https://sites.google.com/view/uap-attacks-on-bc.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Imitation learning methods, one of 13 directions in Offline RL and imitation learning from data. Builds on 22 of its 37 references that are in the map. First posted on arXiv 6 Feb 2025.

Builds on

22 of 37 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023A Survey of Imitation Learning: Algorithms, Recent Developments, and Challenges5 Sep
  2. 2021Implicit Behavioral Cloning1 Sep
  3. 2018An Algorithmic Perspective on Imitation Learning16 Nov
  4. 2018Behavioral Cloning from Observation4 May

Other references · 18

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2023Diffusion Policy: Visuomotor Policy Learning via Action Diffusioncited by 2,730
  7. 2021What Matters in Learning from Offline Human Demonstrations for Robot Manipulationcited by 699
  8. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
  9. 2019Adversarial Policies: Attacking Deep Reinforcement Learningcited by 209
  10. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  11. 2024Behavior Generation with Latent Actionscited by 159
  12. 2017Robust Deep Reinforcement Learning with Adversarial Attackscited by 152
6 more
  1. 2021Robust Reinforcement Learning on State Observations with Learned Optimal Adversarycited by 133
  2. 2023On Bringing Robots Homecited by 101
  3. 2020Stealthy and Efficient Adversarial Attacks against Deep Reinforcement Learningcited by 62
  4. 2019Simple Physical Adversarial Examples against End-to-End Autonomous Driving Modelscited by 17
  5. 2024Diffusion Policy Attacker: Crafting Adversarial Attacks for Diffusion-based Policiescited by 17
  6. 2023Quantifying Assistive Robustness Via the Natural-Adversarial Frontiercited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Immune2V: Image Immunization Against Dual-Stream Image-to-Video Generationcited by 3
  2. 2026Test-time Adversarial Takeover: A Real-time Hijacking Interface against Robotic Diffusion Policiescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Robust Deep Reinforcement Learning against Adversarial Behavior Manipulation
  2. 2019Adversarial Exploitation of Policy Imitation
  3. 2021What Matters for Adversarial Imitation Learning?
  4. 2025Dataset Poisoning Attacks on Behavioral Cloning Policies
  5. 2022ABC: Adversarial Behavioral Cloning for Offline Mode-Seeking Imitation Learning
  6. 2026Non-Adversarial Imitation Learning Provably Free of Compounding Errors: The Value Flow Mechanism
  7. 2026Provably Efficient Policy-Reward Co-Pretraining for Adversarial Imitation Learning
  8. 2021Robust Maximum Entropy Behavior Cloning