mlsanityData to 7 Oct 2026

Dataset Poisoning Attacks on Behavioral Cloning Policies

arXiv 2511.20992 ↗First posted 26 Nov 2025cs.LG cs.CR cs.ROcited by 0

On the map: Offline RL and imitation learning from data → Offline RL algorithms

also in 1 more
Abstract (arXiv)

Behavior Cloning (BC) is a popular framework for training sequential decision policies from expert demonstrations via supervised learning. As these policies are increasingly being deployed in the real world, their robustness and potential vulnerabilities are an important concern. In this work, we perform the first analysis of the efficacy of clean-label backdoor attacks on BC policies. Our backdoor attacks poison a dataset of demonstrations by injecting a visual trigger to create a spurious correlation that can be exploited at test time. We evaluate how policy vulnerability scales with the fraction of poisoned data, the strength of the trigger, and the trigger type. We also introduce a novel entropy-based test-time trigger attack that substantially degrades policy performance by identifying critical states where test-time triggering of the backdoor is expected to be most effective at degrading performance. We empirically demonstrate that BC policies trained on even minimally poisoned datasets exhibit deceptively high, near-baseline task performance despite being highly vulnerable to backdoor trigger attacks during deployment. Our results underscore the urgent need for more research into the robustness of BC policies, particularly as large-scale datasets are increasingly used to train policies for real-world cyber-physical systems. Videos and code are available at https://sites.google.com/view/dataset-poisoning-in-bc.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Offline RL algorithms, one of 13 directions in Offline RL and imitation learning from data. Builds on 23 of its 38 references that are in the map. First posted on arXiv 26 Nov 2025.

Builds on

23 of 38 references.

Closest ancestors · 1

Same direction, newest first

  1. 2022BAFFLE: Hiding Backdoors in Offline Reinforcement Learning Datasets7 Oct

Other references · 22

  1. 2017Proximal Policy Optimization Algorithmscited by 14,441
  2. 2023Diffusion Policy: Visuomotor Policy Learning via Action Diffusioncited by 2,730
  3. 2016OpenAI Gymcited by 1,684
  4. 2016Concrete Problems in AI Safetycited by 1,582
  5. 2023Learning Fine-Grained Bimanual Manipulation with Low-Cost Hardwarecited by 1,490
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  7. 2016End to End Learning for Self-Driving Carscited by 1,000
  8. 2023Open X-Embodiment: Robotic Learning Datasets and RT-X Modelscited by 849
  9. 2024DROID: A Large-Scale In-The-Wild Robot Manipulation Datasetcited by 801
  10. 2018Behavioral Cloning from Observationcited by 482
  11. 2021Implicit Behavioral Cloningcited by 442
  12. 2019Hidden Trigger Backdoor Attackscited by 359
10 more
  1. 2019Label-Consistent Backdoor Attackscited by 285
  2. 2017Inverse Reward Designcited by 246
  3. 2020Blind Backdoors in Deep Learning Modelscited by 174
  4. 2017Tactics of Adversarial Attack on Deep Reinforcement Learning Agentscited by 163
  5. 2020Learning from Suboptimal Demonstration via Self-Supervised Reward Regressioncited by 84
  6. 2022Causal Confusion and Reward Misidentification in Preference-Based Reward Learningcited by 52
  7. 2019Optimal Attacks on Reinforcement Learning Policiescited by 21
  8. 2019Simple Physical Adversarial Examples against End-to-End Autonomous Driving Modelscited by 17
  9. 2024Diffusion Policy Attacker: Crafting Adversarial Attacks for Diffusion-based Policiescited by 17
  10. 2025PNAct: Crafting Backdoor Attacks in Safe Reinforcement Learningcited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models
  2. 2026When Backdoors Meet Partial Observability: Attacking Real-World Reinforcement Learning
  3. 2025How Vulnerable Is My Learned Policy? Universal Adversarial Perturbation Attacks On Modern Behavior Cloning Policies
  4. 2026CS-GBA: A Critical Sample-based Gradient-guided Backdoor Attack for Offline Reinforcement Learning
  5. 2025Density-Ratio Weighted Behavioral Cloning: Learning Control Policies from Corrupted Datasets
  6. 2025Offline Behavioral Data Selection
  7. 2026Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
  8. 2026Evading Chain-of-Thought Monitoring Through Model Poisoning