REVIEW 4 major objections 5 minor 2 cited by
PNAct: Crafting Backdoor Attacks in Safe Reinforcement Learning
T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read The paper claims that a backdoor attack framework called PNAct can train Safe RL agents to take unsafe actions only when specific trigger states appear, while preserving rewards and safe behavior otherwise.
desk verdict PNAct is a genuine new attack idea for Safe RL, but the statistical evidence is too weak to support the paper's central claims, and the theory overreaches. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the pair of positive and negative action samples: when the trigger is present, a positive sample is drawn from the optimal unsafe policy and a negative sample from the optimal safe policy, and the roles are reversed in normal states. The policy is trained to minimize $\lambda J(\mathring{\pi}(s_t), a_t^+) - (1-\lambda) J(\mathring{\pi}(s_t), a_t^-)$, which pulls it toward the desired action and away from the undesired one. This is combined with reward and cost value critics, updated with a Lagrangian-style squared temporal-difference loss, and an attack signal generator $u(f,k,t)$ that controls how often and for how long trigger states appear during training. The B-CMDP model supplies the formal setting by assuming triggers are redundant in state transitions and that normal and backdoor states are disjoint.
What would settle it
Measure the next-state distribution under the same action with and without the vase-position trigger; if $P(s_{t+1} \mid \tilde{x}_t, a_t)$ differs from $P(s_{t+1} \mid x_t, a_t)$, the B-CMDP redundancy assumption fails. Alternatively, retrain PNAct with a trigger that only overlays a pattern in the observation without changing the environment layout; if the backdoor no longer takes effect, the demonstrated attack relies on dynamics changes the model rules out.
Extended reading notes
Core claim
The paper's central claim is that a backdoor policy can be trained to behave as the optimal safe policy in normal states and as the optimal unsafe policy in backdoor states, so that it maximizes reward while violating safety constraints exactly when a trigger is present. The authors formalize this as a property of the policy's action distribution and value functions, and they propose PNAct as a concrete training procedure. PNAct switches positive and negative action samples according to an attack signal, and its loss combines an action-sample loss with reward and cost critic losses in a Lagrangian-style actor-critic update. In the paper's experiments, the trigger is the positioning of objects in the environment, and the trained policy is reported to keep costs below the safety threshold in normal episodes while pushing costs above it in triggered episodes, with rewards at least as high when triggered.
Load-bearing premise
The theory assumes the trigger adds redundant information that leaves the environment's transition dynamics untouched, but in the experiments the trigger is moving vases to fixed positions, which alters the physical layout the agent must navigate.
Editorial extensions
If this is right
- A poisoned Safe RL policy can violate safety constraints at attacker-chosen moments while appearing normal the rest of the time.
- Because the attack does not lower rewards, a defender who monitors only task performance will likely miss it.
- The framework is stated to generalize across environments without scenario-specific trigger specifications, unlike prior STL-based Safe RL backdoors.
- Existing backdoor defenses designed for reward-decreasing attacks are said not to apply, since this attack increases cost rather than decreasing reward.
Reading between the lines
- The paper's experiments use the absolute positions of vases as the trigger, which changes the physical layout the agent must navigate; if that layout change alters transition probabilities, the formal redundancy assumption of B-CMDP is not satisfied by the demonstrated attack.
- A direct implication the paper does not develop is that defending against this attack requires monitoring cost conditioned on environmental configurations, not just aggregate reward or cost statistics.
- The proposed positive and negative action-sample loss could be adapted to other safety specifications, such as risk-sensitive or temporal-logic constraints, by redefining which actions count as safe and unsafe.
- A natural testable extension is to check whether the attack remains effective when the trigger is observation-only and provably does not change the environment dynamics, which would separate the framework's theory from its demonstration.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces PNAct, a backdoor attack framework for Safe Reinforcement Learning. It defines a Backdoored CMDP (B-CMDP) model, formal properties of backdoor policies, and effectiveness/stealthiness metrics, then presents an algorithm that trains a policy to imitate an unsafe policy in trigger states and a safe policy in normal states using positive and negative action samples. Experiments on Safety-Gymnasium (CarGoal, PointGoal, AntGoal) with PPO-Lag, TRPO-Lag, and RCPO as safe base policies and PPO as the unsafe base policy report attack effectiveness and stealthiness indicators for attack intervals n = 5, 10, 15, 20, 25.
Significance. If the results hold, the paper would be a useful contribution to Safe RL security: it proposes evaluation metrics, a general attack framework that does not require per-scenario logic specifications, and an open-source implementation. The attack targets safety constraints rather than merely degrading rewards, which is a meaningful direction for future defenses. The experimental matrix across three environments and three safe-RL algorithms is a strength, as is the availability of code. However, the current evidence does not establish the central claims: the theoretical model is inconsistent with the demonstrated trigger design, and the empirical indicators are point estimates with large variance and multiple configurations already violating the claimed criteria.
major comments (4)
- [Section 4.1 vs. Section 5.1] The B-CMDP model assumes that triggers are redundant and do not change state-transition probabilities, as stated in Section 4.1: P(s_{t+1}|x̃_t,a_t) = P(s_{t+1}|x_t,a_t). The experiments, however, use the absolute positions of five vases as triggers, and vases are physical obstacles that 'block its view and movement' (Section 5.1). Changing vase positions changes the environment layout and therefore the dynamics. Consequently, the disjointness property X ∩ X̃ = ∅ and the subsequent theoretical properties derived from the redundant-trigger assumption do not formally apply to the evaluated attack. This is a load-bearing mismatch because the paper claims theoretical grounding for PNAct. The authors should either use a trigger that is provably observation-only (e.g., a color patch that does not alter dynamics) or generalize the B-CMDP framework to allow P(s_{t+1}|x̃_t,a_t) ≠ P(s_{t+1}|x_t,a_t) and re-derive the properties.
- [Table 1, Section 5.2] The effectiveness and stealthiness indicators I^E and I^S are point estimates computed from 100 episodes with no confidence intervals, hypothesis tests, or per-seed aggregation. The reported standard deviations are enormous; for example, CarGoal n=5 PPO-Lag shows normal cost 23.2±31.35 and backdoor cost 47.8±43.47, and AntGoal n=5 PPO-Lag shows backdoor cost 45.53±101.86 with κ≈25. The standard error of the mean is roughly 2–10, so 95% confidence intervals often overlap the cost threshold κ, and the backdoor–normal cost differences can include zero. Moreover, the table already contains configurations where the indicators are 0, such as PointGoal n=25 PPO-Lag (I^E=0, I^S=0), AntGoal n=20 RCPO (I^E=0), and AntGoal n=25 TRPO-Lag and RCPO (I^E=0). The claim that the attack 'generally' meets effectiveness and stealthiness is therefore not statistically supported. The authors should report per-seed results, significance tests, or bootstrap confidence intervals, and explicitly quantify how many configurations satisfy the indicators.
- [Section 4.3, Eqs. (13)–(14) and Remark 1] The paper asserts that minimizing the action-sample loss L_act satisfies the KL-divergence objective in Eq. (9), but no proof or derivation is provided. The surrogate loss is not equivalent to matching π*_u in backdoor states: the negative-sample term maximizes J(π(s_t), a^-_t), which pushes the policy away from π*_s but does not by itself guarantee convergence to π*_u, and the weighting λ in Eq. (16) introduces a trade-off that is absent from Eq. (9). Because the theoretical properties of PNAct are a stated contribution, the authors should either prove the relationship formally or state precisely the assumptions under which the surrogate is an approximate solution to Eq. (9).
- [Abstract, Section 1, and Table 2] The abstract and Section 1 claim that the attack 'does not affect the rewards obtained by the agent.' Table 2 shows that PNAct's normal-state reward is often lower than the corresponding clean safe policy, for example PointGoal PPO-Lag n=5 normal reward 8.09 vs. the base PPO-Lag normal reward 10.33, and similarly for n=10 (8.34 vs. 10.33) and n=15 (7.38 vs. 10.33). Definition 2's stealthiness indicator only requires V_r(backdoor) ≥ V_r(normal), which does not test reward preservation relative to a clean policy. The claim should be either withdrawn or evaluated against clean baselines with appropriate statistical tests.
minor comments (5)
- [Algorithm 1] The pseudocode for the if-then-else construct is malformed: lines 4–9 place 'end' before the 'else', which is not valid pseudocode. The intended conditional should be written as 'if ψ_t then ... else ... end'.
- [Section 5.2] The distribution analysis states that cumulative rewards and costs are sampled from '1000 rounds' of the PNAct model, while Table 1 says each experiment averages over 100 complete episodes. These numbers should be reconciled.
- [Section 5.1] The cost threshold κ is never explicitly defined in the training configuration. Figure 5 uses a dashed line at y = 25, and Table 1's indicators presumably use κ = 25, but the value should be stated in the text before the results are presented.
- [Global] There are several typographical issues: 'Yanget al.' in Section 1, the grammatically incomplete sentence in the abstract ('It is the first attack framework ... is to implant backdoors'), and inconsistent use of 'as,t' vs. 'a_s,t' in Algorithm 1.
- [Table 1] The table header 'n Safe RLPolicy' is ambiguous; clarifying that n is the attack interval and that the second column lists the safe RL algorithm used for the safe base policy would improve readability.
Circularity Check
No significant circularity; PNAct's trigger-state behavior is largely built into the training objective, but the reported indicators are fresh-rollout evaluations and not end-to-end optimized.
-
self definitional
[Section 4.3, Equations (11) and (13); Definition 1 in Section 4.2]
"a+t ∼ I(st ∈ ˚X) · π∗_u(·|st) + I(st ∈ X) · π∗_s(·|st), a−t ∼ I(st ∈ ˚X) · π∗_s(·|st) + I(st ∈ X) · π∗_u(·|st). ... L˚π_act(st, a+t, a−t) = λJ(˚π(st), a+t) − (1 − λ)J(˚π(st), a−t)."
The backdoor policy is trained to match a+ in backdoor states, where a+ is sampled from π*_u, the optimal unsafe policy defined earlier (Eq. 4) as having V_c > κ. The effectiveness indicator I^E requires V_c(ρ, τ̃) > κ. Thus the reported cost violation under trigger is forced by the training objective when the imitation of π*_u succeeds; it is not an independent discovery. The construction is partially mitigated because the evaluation is on fresh rollouts, the imitation can fail (several Table 1 rows have I^E=0 or I^S=0), and the indicators are not directly optimized end-to-end.
full rationale
The paper is a backdoor-attack construction, not a hidden-prediction paper. The B-CMDP model and Properties 1-2 are formal specifications of the desired backdoor behavior, and the PNAct loss is explicitly designed to realize that specification by imitating π*_u in trigger states and π*_s in normal states. The reported trigger-state cost violations are therefore partly by construction, which is the intended attack mechanism rather than a hidden equivalence. However, this does not rise to significant circularity: the effectiveness and stealthiness indicators are computed on fresh 100-episode rollouts, the attack interval n and loss weights are not fitted to make I^E and I^S pass, and several configurations in Table 1 already violate one or both indicators (e.g., PointGoal n=25 PPO-Lag I^E=0, I^S=0; AntGoal n=20 RCPO I^E=0). The claims are thus empirical demonstrations with a clear design-to-evaluation chain. The more serious concerns are correctness risks, not circularity: Table 1 reports only point estimates with huge variance and no confidence intervals or significance tests, and the trigger-redundancy assumption P(s_{t+1}|x̃_t,a_t)=P(s_{t+1}|x_t,a_t) is questionable when the trigger is the absolute positions of vases, which changes the physical layout and dynamics. Self-citations appear only in related work and comparisons and are not load-bearing. Overall, the derivation chain is self-contained and the central claim has independent experimental content, so a low score is appropriate.
Assumptions & free parameters
free parameters (4)
- lambda (λ) =
not reported
- alpha, beta, mu (α, β, µ) =
not reported
- attack interval n =
scanned over {5,10,15,20,25,50,75,100}
- attack duration k =
set to episode length |τ|
assumptions (5)
- standard math CMDP formulation and Lagrangian relaxation for Safe RL
- domain assumption Triggers are redundant: P(s_{t+1}|x̃_t,a_t) = P(s_{t+1}|x_t,a_t)
- domain assumption Normal and backdoor state sets are disjoint (X ∩ X̃ = ∅)
- domain assumption Optimal safe and unsafe policies exist and can be approximated by trained base models
- ad hoc to paper Minimizing the surrogate action loss (Eq. 13/14) satisfies the KL-divergence objective (Eq. 9)
Cite this review
Pith. "Pith review of PNAct: Crafting Backdoor Attacks in Safe Reinforcement Learning." pith.science (2026). https://pith.science/paper/OMSQJKM7
@misc{pith2026250700485,
author = {Pith},
title = {Pith review of: PNAct: Crafting Backdoor Attacks in Safe Reinforcement Learning},
year = {2026},
howpublished = {\url{https://pith.science/paper/OMSQJKM7}},
note = {Machine review of arXiv:2507.00485}
}
read the original abstract
Reinforcement Learning (RL) is widely used in tasks where agents interact with an environment to maximize rewards. Building on this foundation, Safe Reinforcement Learning (Safe RL) incorporates a cost metric alongside the reward metric, ensuring that agents adhere to safety constraints during decision-making. In this paper, we identify that Safe RL is vulnerable to backdoor attacks, which can manipulate agents into performing unsafe actions. First, we introduce the relevant concepts and evaluation metrics for backdoor attacks in Safe RL. It is the first attack framework in the Safe RL field that involves both Positive and Negative Action sample (PNAct) is to implant backdoors, where positive action samples provide reference actions and negative action samples indicate actions to be avoided. We theoretically point out the properties of PNAct and design an attack algorithm. Finally, we conduct experiments to evaluate the effectiveness of our proposed backdoor attack framework, evaluating it with the established metrics. This paper highlights the potential risks associated with Safe RL and underscores the feasibility of such attacks. Our code and supplementary material are available at https://github.com/azure-123/PNAct.
Figures
Figures from the paper (2 more)
Forward citations
Cited by 2 Pith papers
-
Dataset Poisoning Attacks on Behavioral Cloning Policies
A few doctored demonstrations with a small red patch give attackers near-complete hidden control over behavior-cloning policies without lowering the policy's ordinary task reward.
-
Trojan Attacks on Neural Network Controllers for Robotic Systems
A parallel 'Trojan' neural network that multiply-gates wheel-speed commands can silently immobilize or dangerously accelerate a differential-drive robot inside a chosen trigger region, shown in simulation.
Reference graph
Works this paper leans on
-
[1]
Constrained policy optimiza- tion
[Achiam et al., 2017] Joshua Achiam, David Held, Aviv Tamar, and Pieter Abbeel. Constrained policy optimiza- tion. In Proceedings of the 34th International Confer- ence on Machine Learning , volume 70 of Proceedings of Machine Learning Research, pages 22–31. PMLR, 06–11 Aug
work page 2017
-
[10]
Benchmark- ing batch deep reinforcement learning algorithms
[Fujimoto et al., 2019] Scott Fujimoto, Edoardo Conti, Mo- hammad Ghavamzadeh, and Joelle Pineau. Benchmark- ing batch deep reinforcement learning algorithms. CoRR, abs/1910.01708,
arXiv 2019
-
[13]
Enhancing the robustness of qmix against state-adversarial attacks.Neurocomputing, 572:127191,
[Guo et al., 2024] Weiran Guo, Guanjun Liu, Ziyuan Zhou, Ling Wang, and Jiacun Wang. Enhancing the robustness of qmix against state-adversarial attacks.Neurocomputing, 572:127191,
work page 2024
-
[14]
Robust training in multiagent deep reinforcement learning against optimal adversary
[Guo et al., 2025] Weiran Guo, Guanjun Liu, Ziyuan Zhou, Jiacun Wang, Ying Tang, and Miaomiao Wang. Robust training in multiagent deep reinforcement learning against optimal adversary. IEEE Transactions on Systems, Man, and Cybernetics: Systems, pages 1–12,
work page 2025
-
[17]
Backdoor attacks on safe reinforcement learning- enabled cyber–physical systems
[Jiang et al., 2024] Shixiong Jiang, Mengyu Liu, and Fanxin Kong. Backdoor attacks on safe reinforcement learning- enabled cyber–physical systems. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Sys- tems, 43(11):4093–4104,
work page 2024
-
[18]
Trojdrl: Evaluation of back- door attacks on deep reinforcement learning
[Kiourti et al., 2020] Panagiota Kiourti, Kacper Wardega, Susmit Jha, and Wenchao Li. Trojdrl: Evaluation of back- door attacks on deep reinforcement learning. In 2020 57th ACM/IEEE Design Automation Conference (DAC), pages 1–6,
work page 2020
-
[20]
Con- strained variational policy optimization for safe reinforce- ment learning
[Liu et al., 2022] Zuxin Liu, Zhepeng Cen, Vladislav Isen- baev, Wei Liu, Steven Wu, Bo Li, and Ding Zhao. Con- strained variational policy optimization for safe reinforce- ment learning. In Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvari, Gang Niu, and Sivan Sabato, editors, Proceedings of the 39th International Conference on Machine Lear...
work page 2022
-
[21]
Towards deep learning models resistant to adversarial attacks
[Madry et al., 2018] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations,
work page 2018
Show all 29 references
-
[22]
Marl sim2real transfer: Merging physical reality with digital virtuality in meta- verse
[Shi et al., 2023] Haoran Shi, Guanjun Liu, Kaiwen Zhang, Ziyuan Zhou, and Jiacun Wang. Marl sim2real transfer: Merging physical reality with digital virtuality in meta- verse. IEEE Transactions on Systems, Man, and Cyber- netics: Systems, 53(4):2107–2117,
2023
-
[23]
Responsive safety in reinforcement learn- ing by PID lagrangian methods
[Stooke et al., 2020] Adam Stooke, Joshua Achiam, and Pieter Abbeel. Responsive safety in reinforcement learn- ing by PID lagrangian methods. In Hal Daum ´e III and Aarti Singh, editors, Proceedings of the 37th Interna- tional Conference on Machine Learning , volume 119 of Pro...
2020
-
[24]
Mankowitz, and Shie Mannor
[Tessler et al., 2019] Chen Tessler, Daniel J. Mankowitz, and Shie Mannor. Reward constrained policy optimization. In International Conference on Learning Representations,
2019
-
[25]
Backdoorl: Backdoor attack against competitive reinforcement learn- ing
[Wang et al., 2021] Lun Wang, Zaynah Javed, Xian Wu, Wenbo Guo, Xinyu Xing, and Dawn Song. Backdoorl: Backdoor attack against competitive reinforcement learn- ing. In Zhi-Hua Zhou, editor, Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, ...
2021
-
[27]
Partially observable mean field multi- agent reinforcement learning based on graph attention net- work for uav swarms
[Yang et al., 2023] Min Yang, Guanjun Liu, Ziyuan Zhou, and Jiacun Wang. Partially observable mean field multi- agent reinforcement learning based on graph attention net- work for uav swarms. Drones, 7(7),
2023
-
[28]
First order constrained optimization in policy space
[Zhang et al., 2020] Yiming Zhang, Quan Vuong, and Keith Ross. First order constrained optimization in policy space. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin, editors, Advances in Neural Information Pro- cessing Systems, volume 33, pages 15338–15349. C...
2020
-
[29]
A robust mean-field actor-critic rein- forcement learning against adversarial perturbations on agent states
[Zhou et al., 2024b] Ziyuan Zhou, Guanjun Liu, and Mengchu Zhou. A robust mean-field actor-critic rein- forcement learning against adversarial perturbations on agent states. IEEE Transactions on Neural Networks and Learning Systems, 35(10):14370–14381, 2024
2024
-
[1994]
Safety gymna- sium: A unified safe reinforcement learning benchmark
[Ji et al., 2023] Jiaming Ji, Borong Zhang, Jiayi Zhou, Xue- hai Pan, Weidong Huang, Ruiyang Sun, Yiran Geng, Yi- fan Zhong, Josef Dai, and Yaodong Yang. Safety gymna- sium: A unified safe reinforcement learning benchmark. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hard...
2023
-
[1998]
Constrained policy optimiza- tion via bayesian world models
[As et al., 2022] Yarden As, Ilnura Usmanova, Sebastian Curi, and Andreas Krause. Constrained policy optimiza- tion via bayesian world models. In International Confer- ence on Learning Representations,
2022
-
[2005]
Context-aware safe reinforcement learning for non- stationary environments
[Chen et al., 2021] Baiming Chen, Zuxin Liu, Jiacheng Zhu, Mengdi Xu, Wenhao Ding, Liang Li, and Ding Zhao. Context-aware safe reinforcement learning for non- stationary environments. In 2021 IEEE International Conference on Robotics and Automation (ICRA) , pages 10689–10695,
2021
-
[2012]
[Borkar, 2005] V .S. Borkar. An actor-critic algorithm for constrained markov decision processes. Systems & Con- trol Letters, 54(3):207–213,
2005
-
[2015]
Policycleanse: Backdoor detection and mitiga- tion for competitive reinforcement learning
[Guo et al., 2023] Junfeng Guo, Ang Li, Lixu Wang, and Cong Liu. Policycleanse: Backdoor detection and mitiga- tion for competitive reinforcement learning. In Proceed- ings of the IEEE/CVF International Conference on Com- puter Vision (ICCV), pages 4699–4708, October
2023
-
[2017]
Constrained markov decision processes with total cost criteria: Lagrangian approach and dual linear program
[Altman, 1998] Eitan Altman. Constrained markov decision processes with total cost criteria: Lagrangian approach and dual linear program. Mathematical methods of operations research, 48:387–417,
1998
-
[2018]
Badrl: Sparse targeted backdoor attack against reinforcement learning
[Cui et al., 2024] Jing Cui, Yufei Han, Yuzhe Ma, Jianbin Jiao, and Junge Zhang. Badrl: Sparse targeted backdoor attack against reinforcement learning. Proceedings of the AAAI Conference on Artificial Intelligence, 38(10):11687– 11694, Mar
2024
-
[2019]
Goodfellow, Jonathon Shlens, and Christian Szegedy
[Goodfellow et al., 2015] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun, editors, 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015...
2015
-
[2020]
[Liang et al., 2018] Qingkai Liang, Fanyu Que, and Eytan H. Modiano. Accelerated primal-dual policy optimization for safe reinforcement learning. CoRR, abs/1802.06480,
2018 arXiv
-
[2021]
[Yang et al., 2020] Tsung-Yen Yang, Justinian Rosca, Karthik Narasimhan, and Peter J
Main Track. [Yang et al., 2020] Tsung-Yen Yang, Justinian Rosca, Karthik Narasimhan, and Peter J. Ramadge. Projection- based constrained policy optimization. CoRR, abs/2010.03152,
2020 arXiv
-
[2022]
An online actor–critic algorithm with function approximation for constrained markov decision processes
[Bhatnagar and Lakshmanan, 2012] Shalabh Bhatnagar and K Lakshmanan. An online actor–critic algorithm with function approximation for constrained markov decision processes. Journal of Optimization Theory and Applica- tions, 153:688–708,
2012
-
[2023]
Robust multi- agent reinforcement learning method based on adversar- ial domain randomization for real-world dual-uav co- operation
[Chen et al., 2024] Shutong Chen, Guanjun Liu, Ziyuan Zhou, Kaiwen Zhang, and Jiacun Wang. Robust multi- agent reinforcement learning method based on adversar- ial domain randomization for real-world dual-uav co- operation. IEEE Transactions on Intelligent Vehicles , 9(1):1615–1627,
2024
-
[2024]
Risk-constrained reinforcement learning with percentile risk criteria
[Chow et al., 2018] Yinlam Chow, Mohammad Ghavamzadeh, Lucas Janson, and Marco Pavone. Risk-constrained reinforcement learning with percentile risk criteria. Journal of Machine Learning Research , 18(167):1–51,
2018
-
[2025]
Consideration of risk in re- inforcement learning
[Heger, 1994] Matthias Heger. Consideration of risk in re- inforcement learning. In William W. Cohen and Haym Hirsh, editors, Machine Learning Proceedings 1994 , pages 105–111. Morgan Kaufmann, San Francisco (CA),
1994
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.