Adversarially Trained Weighted Actor-Critic for Safe Offline Reinforcement Learning

Authors: honghao  wei
xiyue  peng
arnob  ghosh
xin  liu
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-15 08:18:14

Abstract: We propose WSAC (Weighted Safe Actor-Critic), a novel algorithm for Safe Offline Reinforcement Learning (RL) under functional approximation, which can robustly optimize policies to improve upon an arbitrary reference policy with limited data coverage. WSAC is designed as a two-player Stackelberg game to optimize a refined objective function. The actor optimizes the policy against two adversarially trained value critics with small importance-weighted Bellman errors, which focus on scenarios where the actor's performance is inferior to the reference policy. In theory, we demonstrate that when the actor employs a no-regret optimization oracle, WSAC achieves a number of guarantees: $(i)$ For the first time in the safe offline  RL setting, we establish that WSAC can produce a policy that outperforms {\bf any} reference policy while maintaining the same level of safety, which is critical to designing a safe algorithm for offline RL. $(ii)$ WSAC achieves the optimal statistical convergence rate of $1/\sqrt{N}$ to the reference policy, where $N$ is the size of the offline dataset. $(iii)$ We theoretically show that WSAC guarantees a safe policy improvement across a broad range of hyperparameters that control the degree of pessimism, indicating its practical robustness. Additionally, we offer a practical version of WSAC and compare it with existing state-of-the-art safe offline RL algorithms in several continuous control environments. WSAC outperforms all baselines across a range of tasks, supporting the theoretical results.

Main paper: 
 introduction: 
 Online safe reinforcement learning (RL) has found successful applications in various domains, such as autonomous driving (Isele et al., 2018) , recommender systems (Chow et al., 2017) , and robotics (Achiam et al., 2017) . It enables the learning of safe policies effectively while satisfying certain safety constraints, including collision avoidance, budget adherence, and reliability. However, collecting diverse interaction data can be extremely costly and infeasible in many real-world applications, and this challenge becomes even more critical in scenarios where risky behavior cannot be tolerated. Given the inherently risk-sensitive nature of these safety-related tasks, data collection becomes feasible only when employing behavior policies satisfies all the safety requirements.To overcome the limitations imposed by interactive data collection, offline RL algorithms are designed to learn a policy from an available dataset collected from historical experiences by some behavior policy, which may differ from the policy we aim to learn. A desirable property of an effective offline algorithm is the assurance of robust policy improvement (RPI), which guarantees that a learned policy is always at least as good as the baseline behavior policies (Fujimoto et al., 2019; Laroche et al., 2019; Kumar et al., 2019; Siegel et al., 2020; Chen et al., 2022a; Zhu et al., 2023; Bhardwaj et al., 2024) . We extend the property of RPI to offline safe RL called safe robust policy improvement (SRPI), which indicates the improvement should be safe as well. This is particularly important in offline safe RL. For example, in autonomous driving, an expert human driver operates the vehicle to collect a diverse dataset under various road and weather conditions, serving as the behavior policy. This policy is considered both effective and safe, as it demonstrates proficient human driving behavior while adhering to all traffic laws and other safety constraints. Achieving a policy that upholds the SRPI characteristic with such a dataset can significantly mitigate the likelihood of potential collisions and other safety concerns.Figure 1 : Comparison between WSAC and the behavior policy in the tabular case. The behavior policy is a mixture of the optimal policy and a random policy, with the mixture percentage representing the proportion of the optimal policy. The cost threshold is set to 0.1. We observe that WSAC consistently ensures a safely improved policy across various scenarios, even when the behavior policy is not safe.In offline RL, we represent the state-action occupancy distribution of policy π over the dataset distribution µ using the ratio w π = d π /µ. A commonly required assumption is that the ℓ ∞ concentrability C π ℓ∞ is bounded, which is defined as the infinite norm of w π for all policies (Liu et al., 2019; Chen and Jiang, 2019; Wang et al., 2019; Liao et al., 2022; Zhang et al., 2020) . A stronger assumption requires a uniform lower bound on µ(a|s) (Xie and Jiang, 2021) . However, such all-policy concentrability assumptions are difficult to satisfy in practice, particularly for offline safe RL, as they essentially require the offline dataset to have good coverage of all unsafe stateaction pairs. To address the full coverage requirement, other works (Rashidinejad et al., 2021; Zhan et al., 2022; Chen and Jiang, 2022; Xie et al., 2021; Uehara and Sun, 2021) adapt conservative algorithms by employing the principle of pessimism in the face of uncertainty, reducing the assumption to the best covered policy (or optimal policy) concerning ℓ ∞ concentrability. Zhu et al. (2023) introduce ℓ 2 concentrability to further relax the assumption, indicating that ℓ ∞ concentrability is always an upper bound of ℓ 2 concentrability (see Table 1 for detailed comparisons with previous works). While provable guarantees are obtained using single policy concentrability for unconstrained MDP as Table 1 suggests for the safe RL setting, all the existing studies (Hong et al., 2024; Le et al., 2019) still require the coverage on all the policies. Further, as Table 1 suggests, the above papers do not guarantee robust safe policy improvement. Our main contributions are summarized below:1. We prove that our algorithm, which uses average Bellman error, enjoys an optimal statistical rate of 1/ √ N under partial data coverage assumption. This is the first work that achieves such a result using only single-policy ℓ 2 concentrability.2. We propose a novel offline safe RL algorithm, called Weighted Safe Actor-Critic (WSAC), which can robustly learn policies that improve upon any behavior policy with controlled relative pessimism. We prove that under standard function approximation assumptions, when the actor incorporates a no-regret policy optimization oracle, WSAC outputs a policy that never degrades the performance of a reference policy (including the behavior policy) for a range of hyperparameters (defined later). This is the first work that provably demonstrates the property of SRPI in offline safe RL setting.3. We point out that primal-dual-based approaches Hong et al. (2024) may require all-policy concentrability assumption. Thus, unlike, the primal-dual-based appraoch, we propose a novel rectified penalty-based approach to obtain results using single-policy concentrability. Thus, we need novel analysis techniques to prove results.4. Furthermore, we provide a practical implementation of WSAC following a two-timescale actorcritic framework using adversarial frameworks similar to Cheng et al. (2022) ; Zhu et al. (2023) , and test it on several continuous control environments in the offline safe RL benchmark (Liu et al., 2023a) . WSAC outperforms all other state-of-the-art baselines, validating the property of a safe policy improvement. , detailed definitions and more discussions can be found in Section 3.3. guarantees. To the best of our knowledge, the investigation of policy improvement properties in offline safe RL is relatively rare in the state-of-the-art offline RL literature. Wu et al. (2021) focus on the offline constrained multi-objective Markov Decision Process (CMOMDP) and demonstrate that an optimal policy can be learned when there is sufficient data coverage. However, although they show that CMDP problems can be formulated as CMOMDP problems, they assume a linear kernel CMOMDP in their paper, whereas our consideration extends to a more general function approximation setting. Le et al. (2019) propose a model-based primal-dual-type algorithm with deviation control for offline safe RL in the tabular setting. With prior knowledge of the slackness in Slater's condition and a constant on the concentrability coefficient, an (ϵ, δ)-PAC error is achievable when the number of data samples N is large enough (N = Õ(1/ϵ 2 )). These assumptions make the algorithm impractical, and their computational complexity is much higher than ours. Additionally, we consider a more practical, model-free function approximation setting. In another concurrent work (Hong et al., 2024) , a primal-dual critic algorithm is proposed for offline-constrained RL settings with general function approximation. However, their algorithm requires ℓ 2 concentrability for all policies, which is not practical as discussed. The reason is that the dual variable optimization in their primal-dual design requires an accurate estimation of all the policies used in each episode, which necessitates coverage over all policies. Moreover, they cannot guarantee the property of SRPI. Moreover, their algorithm requires an additional offline policy evaluation (OPE) oracle for policy evaluation, making the algorithm less efficient. 
constrained markov decision process: 
 We consider a Constrained Markov Decision Process (CMDP) M, denoted by (S, A, P, R, C, γ, ρ). S is the state space, A is the action space, P : S × A → ∆(S) is the transition kernel, where∆(•) is a probability simplex, R : S × A → [0, 1] is the reward function, C : S × A → [-1, 1] is the cost function, γ ∈ [0, 1)is the discount factor and ρ : S → [0, 1] is the initial state distribution. We assume A is finite while allowing S to be arbitrarily complex. We use π : S → ∆(A) to denote a stationary policy, which specifies a distribution over actions for each state. At each time, the agent observes a state s t ∈ S, takes an action a t ∈ S according to a policy π, receives a reward r t and a cost c t , where r t = R(s t , a t ), c t = C(s t , a t ). Then the CMDP moves to the next state s t+1 based on the transition kernel P(•|s t , a t ). Given a policy π, we use V π r (s) and V π c (s) to denote the expected discounted return and the expected cumulative discounted cost of π, starting from state s, respectively.V π r (s) :=E[ ∞ t=0 γ t r t |s 0 = s, a t ∼ π(•|s t )](1)EQUATIONAccordingly, we also define the Q-value function of a policy π for the reward and cost asEQUATIONEQUATIONrespectively. As rewards and costs are bounded, we have that 0≤ Q π r ≤ 1 1-γ , and -1 1-γ ≤ Q π c ≤ 1 1-γ . We let V max = 1 1-γ to simplify the notation. We further write J r (π) := (1 -γ)E s∼ρ [V π r (s)], J c (π) := (1 -γ)E s∼ρ [V π c (s)]to represent the normalized average reward/cost value of policy π. In addition, we use d π (s, a) to denote the normalized and discounted state-action occupancy measure of the policy π :d π (s, a) := (1 -γ)E[ ∞ t=0 γ t 1(s t = s, a t = a)|a t ∼ π(•|s t )],where 1(•) is the indicator function. We also use d π (s) = a∈A d π (s, a) to denote the discounted state occupancy and we use E π as a shorthand of E (s,a)∼d π [•] or E s∼d π [•]to denote the expectation with respect to d π . Thus The objective in safe RL for an agent is to find a policy such that π ∈ arg max J r (π) s.t. J c (π) ≤ 0.(5)Remark 3.1. For ease of exposition, this paper exclusively focuses on a single constraint. However, it is readily extendable to accommodate multiple constraints.In complex environments, the state space S is usually very large or even infinite. We assume access to a policy class Π ⊆ (S → ∆(A)) consisting of all candidate policies from which we can search for good policies. We also assume access to a value function classF ⊆ (S × A → [0, V max ]) to model the reward Q-functions, and G ⊆ (S × A → [-V max , V max ]) to model the cost Q-functions of candidate policies. We further assume access to a function class W ∈ {w : S × A → [0, B w ]} that represents marginalized importance weights with respect to the offline data distribution. Without loss of generality, we assume that the all-one function is contained in W.For a given policy π ∈ Π, we denote f (s ′ , π) := a ′ π(a ′ |s ′ )f (s ′ , a ′ ) for any s ∈ S. The Bellman operator T π r : R S×A → R S×A for the reward is defined as(T π r f )(s, a) := R(s, a) + γE P(s ′ |s,a) [f (s ′ , π)],The Bellman operator T π c : R S×A → R S×A for the cost is(T π c f )(s, a) := C(s, a) + γE P(s ′ |s,a) [f (s ′ , π)]. Let ∥ • ∥ 2,µ := E µ [(•) 2] denote the Euclidean norm weighted by distribution µ. We make the following standard assumptions in offline RL setting (Xie et al., 2021; Cheng et al., 2022; Zhu et al., 2023) on the representation power of the function classes:Assumption 3.2 (Approximate Realizability). Assume there exists ϵ 1 ≥ 0, s.t. for any given policy π ∈ Π, we have min f ∈F max admissible ν ∥f -T π r f ∥ 2 2,ν ≤ ϵ 1 , and min f ∈F max admissible ν ∥f -T π c f ∥ 2 2,ν ≤ ϵ 1 , where ν is the state-action distribution of any admissible policy such that ν ∈ {d π , ∀π ∈ Π}. Assumption 3.2 assumes that for any policy π ∈ Π, Q π r and Q π c are approximately realizable in F and G. When ϵ 1 is small for all admissible ν, we have f r ≈ Q π r , and f c ≈ Q π c . In particular, when ϵ 1 = 0, we have Q π r ∈ F, Q π c ∈ F for any policy π ∈ Π. Note that we do not need Bellman completeness assumption Cheng et al. (2022) .In offline RL, we assume that the available offline data D = {(s i , a i , r i , c i , s ′ i )} N i=1 consists of N samples. Samples are i.i.d. (which are common assumptions in unconstrained Cheng et al. (2022) , as well as constrained setting Hong et al. (2024) ), and the distribution of each tuple (s, a, r, c, s ′ ) is specified by a distribution µ ∈ ∆(S × A), which is also the discounted visitation probability of a behavior policy (also denoted by µ for simplicity). In particular, (s, a) ∼ µ, r = R(s, a), c = C(s, a), s ′ ∼ P(•|s, a). We use a ∼ µ(•|s), to denote that the action is drawn using the behavior policy and (s, a, s ′ ) ∼ µ to denote that (s, a) ∼ µ, and s ′ ∼ P(•|s, a).For a given policy π, we define the marginalized importance weights w π (s, a) := d π (s,a)µ(s,a) which is the ratio between the discounted state-action occupancy of π and the data distribution µ. This ratio can be used to measure the concentrability of the data coverage (Xie and Jiang, 2020; Zhan et al., 2022; Rashidinejad et al., 2022; Ozdaglar et al., 2023; Lee et al., 2021) .In this paper we study offline RL with access to a dataset with limited coverage. The coverage of a policy π is the dataset can be measured by the weighted ℓ 2 single policy concentrability coefficient (Zhu et al., 2023; Yin and Wang, 2021; Uehara et al., 2024; Hong et al., 2024) : Definition 3.3 (ℓ 2 Concentrability). Given a policy π, define C π ℓ2 = ∥w π ∥ 2,µ = ∥d π /µ∥ 2,µ . Remark 3.4. The definition here is much weaker than the all policy concentrability used in offline RL (Chen and Jiang, 2019) and safe offline RL (Le et al., 2019; Hong et al., 2024) , which requires the ratio d π (s,a)µ(s,a) to be bounded for all s ∈ S and a ∈ A and all policies π. In particular, the all-policy concentrability assumption essentially requires the dataset to have full coverage of all policies ((nearly all the state action pairs). This requirement is often violated in practical scenarios. This requirement is even impossible to meet in safe offline RL because it would require collecting data from every dangerous state and actions, which clearly is impractical.In the following lemma, we compare two variants of single-policy concentrability definition with the ℓ 2 defined in Definition 3.3. Lemma 1 (Restate Proposition 2.1 in Zhu et al. (2023) ). Define the ℓ ∞ single policy concentrability (Rashidinejad et al., 2021) as C π ℓ∞ = ∥d π /µ∥ ∞ and the Bellman-consistent single-policy concentrability (Xie et al., 2021) asC π Bellman = max f ∈F ∥f -T π f ∥ 2 2,d π ∥f -T π f ∥ 2 2,µ(T could be T r or T c in our setting) Then, it always holds (C π ℓ2 ) 2 ≤ C π ℓ∞ , C π ℓ2 ≤ C π ℓ∞ and there exist offline RL instances where(C π ℓ2 ) 2 ≤ C π Bellman , C π ℓ2 ≤ C πBellman . Remark 3.5. It is easy to observe that the ℓ 2 variant is bounded by ℓ ∞ and C π Bellman under some cases. There is an example (Example 1) in Zhu et al. (2023) showing that C π ℓ2 is bounded by a constant √ 2 while C π ℓ∞ could be arbitrarily large. For the case when the function class F is highly expressive, C π Bellman could be close to C π ℓ∞ and thus possibly larger than C π ℓ2 . Intuitively, C π ℓ2 implies that onlyE d π [w π (s, a)] is bounded, rather, w π (s, a) is bounded for all (s, a) in ℓ ∞ concentrability bound.Given the definition of the concentrability, we make the following assumption on the weight function class W and a single-policy realizability: Assumption 3.6 (Boundedness of W in ℓ 2 norm). For all w ∈ W, assume that ∥w∥ 2,µ ≤ C * ℓ2 . Assumption 3.7 (Single-policy realizability of w π ). For some policy π that we would like to compete with, assume that w π ∈ W.In this paper, we want to study the robust policy improvement on any reference policy, then we assume that we are provided a reference policy π ref . Note that in many applications (e.g., scheduling, networking) we indeed have a reference policy. We want that while applying a sophisticated RL policy it should do better and be safe as well. This is one of the main motivations behind this assumption. Assumption 3.8 (Reference Policy). We assume access to a reference policy π ref ∈ Π, which can be queried at any state.In many applications such as networking, scheduling, and control problems, there are existing good enough reference policies. In these cases, a robust and safe policy improvement over these reference policies has practical value. If π ref is not provided, we can simply run a behavior cloning on the offline data to extract the behavior policy as π ref accurately, as long as the size of the offline data set is large enough. More discussion can be found in Section C in the Appendix. 
actor-critic with importance weighted bellman error: 
 Our algorithm design builds upon the constrained actor-critic method, in which we iteratively optimize a policy and improve the policy based on the evaluation of reward and cost. Consider the following actor-critic approach for solving the optimization problem (5):Actor: π * ∈ arg max π∈Π f π r (s 0 , π) s.t. f π c (s 0 , π) ≤ 0 Critic: f π r ∈ arg min f ∈F E µ [((f -T r f )(s, a)) 2 ], f π c ∈ arg min f ∈G E µ [((f -T c f )(s, a)) 2 ],where we assume that s 0 is a fixed initial state, and f r (s, π) = a∈A π(a|s)f r (s, a), f c (s, π) = a∈A π(a|s)f c (s, a). The policy is optimized by maximizing the reward q function f r while ensuring that f c satisfies the constraint, and the two functions are trained by minimizing the Bellman error. However, this formulation has several disadvantages. 1) It cannot handle insufficient data coverage, which may fail to provide an accurate estimation of the policy for unseen states and actions. 2)It cannot guarantee robust policy improvement. 3) The actor training step is computationally intractable especially when the policy space is extremely large.To address the insufficient data coverage issue, as mentioned in Xie et al. (2021) the critic can include a Bellman-consistent pessimistic evaluation of π, which selects the most pessimistic function that approximately satisfies the Bellman equation, which is called absolute pessimism. Then later as indicated by Cheng et al. (2022) , instead of using an absolute pessimism, a relative pessimism approach by considering competing to the behavior policy can obtain a robust improvement over the behavior policy. However, this kind of approach can only achieve a suboptimal statistical rate of N 1/3 , and fails to achieve the optimal statistical rate of 1/ √ N , then later a weighted average Bellman error (Uehara et al., 2020; Xie and Jiang, 2020; Zhu et al., 2023) could be treated as one possible solution for improving the order. We remark here that all the discussions here are for the traditional unconstrained offline RL. Regarding safety, no existing efficient algorithms in safe offline RL have theoretically demonstrated the property of robust policy improvement with optimal statistical rate.Can Primal-dual based approaches achieve result using only single policy coverability?: The most commonly used approach for addressing safe RL problems is primal-dual optimization (Efroni et al., 2020; Altman, 1999) . As shown in current offline safe RL literature (Hong et al., 2024; Le et al., 2019) , the policy can be optimized by maximizing a new unconstrained "reward" Qfunctionf π r (s 0 , π) -λf π c (s 0 , π)where λ is a dual variable. Then, the dual-variable can be tuned by taking gradient descent step. As we discussed in the introduction, all these require all policy concentrability which is not practical especially for safe RL. Important question is whether all policy concentrability assumption can be relaxed. Note that primal-dual algorithm relies on solving the min-max problem min λ max π f π r (s 0 , π) -λf π c (s 0 , π). Recent result (Cui and Du, 2022) shows that single policy concentrability assumption is not enough for offline min-max game. Hence, we conjecture that using the primal-dual method we can not relax the all policy concentrability assumption. Intuitively, the primal-dual based method (Hong et al., 2024) rely on bounding the regret in dual domaink (λ k -λ * )(f π k c -0), hence, all the policies {π k } K k=1 encountered throughout the iteration must be supported by the dataset to evaluate the dual value λ * (f π k c -0) where λ * is the optimal dual value. Our novelty: In contrast, we propose an aggression-limited objective function f r (s 0 , π) -λ • [f c (s 0 , π)] + to control aggressive policies, where {•} + := max{•, 0}. The high-level intuition behind this aggression-limited objective function is that by appropriately selecting a λ (usually large enough), we penalize all the policies that are not safe. As a result, the policy that maximizes the objective function is the optimal safe policy. This formulation is fundamentally different from the traditional primal-dual approach as it does not require dual-variable tuning, and thus, does not require all policy concentrability. In particular, we only need to bound the primal domain regret which can be done as long as the reference policy is covered by the dataset similar to the unconstrained setup.Combining all the previous ideas together provides the design of our main algorithm named WSAC (Weighted Safe Actor-Critic). In Section 5, we will provide theoretical guarantees of WSAC and discuss its advantages over existing approaches in offline safe RL. WSAC aims to solve the following optimization problem:EQUATIONwhereL µ (π, f ) := E µ [f (s, π) -f (s, a)], and E µ (π, f ) := max w∈W |E µ [w(s, a)((f - T π r f )(s, a))]|, Êµ (π, f ) := max w∈W |E µ [w(s, a)((f -T π c f )(s, a))]|.This formulation can also be treated as a Stackelberg game (Von Stackelberg, 2010) or bilevel optimization problem. We penalize the objective function only when the approximate cost Q-function f π c of the policy π is more perilous than the behavior policy (f π c (s, π) ≥ f π c (s, a)) forcing our policy to be as safe as the behavior policy. Maximization over w in for training the two critics can ensure that the Bellman error is small when averaged over measure µ • w for any w ∈ W, which turns out to be sufficient to control the suboptimality of the learned policy.In the following theorem, we show that the solution of the optimization problem ( 6) is not worse than the behavior policy µ in both performance and safety for any β ≥ 0, λ > 0 than the policy µ under Assumption 3.2 with ϵ 1 = 0. Theorem 4.1. Assume that Assumption 3.2 holds with ϵ 1 = 0, and the behavior policy µ ∈ Π, then for any β ≥ 0, λ > 0 we have J r (π * ) ≥ J r (µ), and{J c (π * )} + ≤ {J c (µ)} + + 1 λ .The result in Theorem 4.1 shows that by selecting λ large enough, for any β ≥ 0, the solution can achieve better performance than the behavior policy while maintaining safety that is arbitrarily close to that of the behavior policy. The Theorem verifies the design of our framework which has the potential to have a robust safe improvement.In the next section, we will introduce our main algorithm WSAC and provide its theoretical guarantees.5 Theoretical Analysis of WSAC 
main algorithm: 
 In this section, we present the theoretical version of our new model-free offline safe RL algorithm WSAC. Since we only have access to a dataset D instead of the data distribution. WSAC sovles an empirical version of (6):EQUATIONwhereEQUATIONAs shown in Algorithm 1, at each iteration, WSAC selects f k r maximally pessimistic and f k c maximally optimistic for the current policy π k with a weighted regularization on the estimated Bellman error for reward and cost, respectively (Line 4 and 6) to address the worse cases within reasonable range. In order to achieve a safe robust policy improvement, the actor then applies a no-regret policy optimization oracle to update the policy π k+1 by optimizing the aggressionlimited objective function compared with the reference policy (Line 7) f k r (s, a) -λ{f k c (s, a) -f k r ← arg min fr∈F L D (π k , f r ) + βE D (π k , f r ) 5:Obtain the cost state-action value function estimation of π k :6:f k c ← arg min fc∈G -λL D (π k , f c ) + β ÊD (π k , f c ) 7:Update policy:π k+1 ← PO(π k , f k r (s, a) -λ{f k c (s, a) -f k c (s, π ref )} + , D). // L D , E D , ÊD are defined in (5.1) 8: end for 9: Output: π = Unif(π 1 , . . . , π K ). // Uniformly mix π 1 , . . . , π K f k c (s, π ref )} + .Our algorithm is very computationally efficient and tractable compared with existing approaches (Hong et al., 2024; Le et al., 2019) , since we do not need another inner loop for optimizing the dual variable with an additional online algorithm or offline policy evaluation oracle. The policy improvement process relies on a no-regret policy optimization oracle, a technique commonly employed in offline RL literature (Zhu et al., 2023; Cheng et al., 2022; Hong et al., 2024; Zhu et al., 2023) . Extensive literature exists on such methodologies. For instance, approaches like soft policy iteration (Pirotta et al., 2013) and algorithms based on natural policy gradients (Kakade, 2001; Agarwal et al., 2021) can function as effective no-regret policy optimization oracles. We now formally define the oracle: Definition 5.1 (No-regret policy optimization oracle). An algorithm PO is called a no-regret policy optimization oracle if for any sequence of functions f1 , . . . , f K with f k : S × A → [0, V max ], ∀k ∈ [K].The policies π 1 , . . . , π K produced by the oracle PO satisfy that for any policy π ∈ Π :EQUATIONThere indeed exist many methods that can serve as the no-regret oracle, for example, the mirrordescent approach (Geist et al., 2019) or the natural policy gradient approach (Kakade, 2001) Lemma 2. Applying a no-regret oracle PO for K episodes with (f k r (s, a)-λ{f k c (s, a)-f k c (s, π)} + ) for an arbitrary policy π, can guaranteeEQUATION)Lemma 2 establishes that the policy outputted by PO with considering the aggression-limited "reward" can have a strong guarantee on the performance of both reward and cost when λ is large enough., which is comparable with any competitor policy. This requirement is critical to achieving the performance guarantee of our algorithm and the safe and robust policy improvement. The detailed proof is deferred to Appendix B.2 due to page limit.We are now ready to provide the theoretical guarantees of WSAC Algorithm 1. The complete proof is deferred to Appendix B.3.Theorem 5.2 (Main Theorem). Under Assumptions 3.2 and 3.6, let the reference policy π ref ∈ Π in Algorithm 1 be any policy satisfying Assumption 3.7, then with probability at least 1 -δ,EQUATIONwhereϵ stat := V max C * ℓ2 log(|F ||Π||W |/δ) N + VmaxBw log(|F ||Π||W |/δ) N, and π is the policy returned by Algorithm 1 with β = 2 and π ref as input. Remark 5.3. When ϵ 1 = 0, i.e., no model misspecification, which states that the true value function belongs to the function class being used to approximate it (the function class is right enough), let π ref be the optimal policy, the results in Theorem 5.2 achieve an optimal dependence statistical rate of 1 √ N (for large k), which matches the best existing results. Our algorithm is both statistically optimal and computationally efficient with only single-policy assumption rather relying much stronger assumptions of all policy concentrability Hong et al. (2024) ; Le et al. (2019) . Hence, if the behavior policy or the reference policy is safe, our result indicates that the policy returned by our algorithm will also be safe (nearly). Such a guarantee was missing in the existing literature. Remark 5.4. We also do not need a completeness assumption,which requires that for any f ∈ F or G and π ∈ Π, it approximately holds that T r f ∈ F, T c f ∈ F as required in Xie et al. (2021) ; Chen et al. (2022b) . They need this assumption to address over-estimation issues caused by the ℓ 2 square Bellman error, but our algorithm can get rid of the strong assumption by using a weighted Bellman error which is a simple and unbiased estimator. Remark 5.5. Our algorithm can compete with any reference policy π ref ∈ Π as long as w πref = d πref /µ is contained in W. The importance ratio of the behavior policy is w µ = d µ /µ = µ/µ = 1 which always satisfies this condition, implying that our algorithm can have a safe robust policy improvement (in Theorem 5.6 discussed below).A Robust policy improvement (RPI) (Cheng et al., 2022; Zhu et al., 2023; Bhardwaj et al., 2024) refers to the property of an offline RL algorithm that the offline algorithm can learn to improve over the behavior policy, using a wide range of hyperparameters. In this paper, we introduce the property of Safe Robust policy improvement (SRPI) such that the offline algorithm can learn to improve over the behavior policy in both return and safety, using a wide range of hyperparameters. In the following Theorem 5.6 we show that as long as the hyperparameter β = o( √ N ), our algorithm can, with high probability, produce a policy with vanishing suboptimality compared to the behavior policy. Theorem 5.6 (SRPI). Under Assumptions 3.2 and 3.6, then with probability at least 1 -δ,EQUATIONwhereϵ stat := V max C * ℓ2 log(|F ||Π||W |/δ) N + VmaxBw log(|F ||Π||W |/δ) N, and π is the policy returned by Algorithm 1 with β ≥ 0 and µ as input.The detailed proofs are deferred to Appendix B.4.Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?Answer: [Yes] Justification: We provide the data and code.Guidelines:• The answer NA means that paper does not include experiments requiring code. • Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted. 
wsac-practical implementation: 
 We introduce a deep RL implementation of WSAC in Algorithm 2 (in Appendix), following the key structure of its theoretical version (Algorithm 1). The reward, cost Q-functions f r , f c and the policy network π are all parameterized by neural networks. The critic losses (line 4) l reward (f r ) and l cost (f c ) are calculated based on the principles of Algorithm 1, on the minibatch dataset. Optimizing the actor aims to achieve a no-regret optimization oracle, we use a gradient based update on the actor loss (line 5) l actor (π). In the implementation we use adaptive gradient descent algorithm ADAM (Kingma and Ba, 2015) for updating two critic networks and the actor network. Algorithm follows standard two-timescale first-order algorithms (Fujimoto et al., 2018; Haarnoja et al., 2018) with a fast learning rate η f ast on update critic networks and a slow learning rate η slow for updating the actor.We We study several representative environments and focus on presenting "BallCircle". In BallCircle, it requires the ball on a circle in a clockwise direction without leaving the safety zone defined by the boundaries as proposed by Achiam et al. (2017) . The ball is a spherical-shaped agent which can freely move on the xy-plane. The reward is dense and increases by the car's velocity and by the proximity towards the boundary of the circle. The cost is incurred if the agent leaves the safety zone defined by the boundaries.We use the offline dataset from Liu et al. (2019) , where the corresponding expert policy are used to interact with the environments and collect the data. To better illustrate the results, we normalize the reward and cost. Our simulation results are reported in Table 2 , we observe that WSAC can guarantee that all the final agents are safe, which is most critical in safe RL literature. Even in challenging environments such as PointButton, which most baselines fail to learn safe policies. WSAC has the best results in 3 of the environments. Moreover, WSAC outperforms all the baselines in terms of the average performance, demonstrating its ability to learn a safe policy by leveraging an offline dataset. The simulation results verify our theoretical findings. We also compared WSAC with all the baselines in the case where the cost limits are different, WSAC still outperforms all the other baselines and ensures a safe policy. We further include simulations to investigate the contribution of each component of our algorithm, including the weighted Bellman regularizer, the aggression-limited objective, and the no-regret policy optimization which together guarantee the theoretical results. More details and discussions are deferred to the Appendix D due to page limit.Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results? Answer: [Yes] Justification: The Experimental setting and details are in Appendix.Guidelines:• The answer NA means that the paper does not include experiments.• The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 7. Experiment Statistical Significance Question: the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments? Answer: [Yes] Justification: In the experiment, we used multiple random seeds to ensure the statistical significance of the results. Guidelines:• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors).• It should be clear whether the error bar is the standard deviation or the standard error of the mean. • It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified. • For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates). • If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text. 
conclusion: 
 In this paper, we explore the problem of offline Safe-RL with a single policy data coverage assumption.We propose a novel algorithm, WSAC, which, for the first time, is proven to guarantee the property of safe robust policy improvement. WSAC is able to outperform any reference policy, including the behavior policy, while maintaining the same level of safety across a broad range of hyperparameters.Our simulation results demonstrate that WSAC outperforms existing state-of-the-art offline safe-RL algorithms. Interesting future work includes combining WSAC with online exploration with safety guarantees and extending the approach to multi-agent settings to handle coupled constraints. 
experiments compute resources: 
 Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments? Answer: [Yes] Justification: We specified the computational resources we used in the Appendix. Guidelines:• The answer NA means that the paper does not include experiments.• The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.• The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper). 
code of ethics: 
 Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines?Answer: [Yes] Justification: This paper is theoretical in nature, and it has been conducted with the NeurIPS code of Ethics.Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes] Justification: This paper has tremendous positive societal impact as it develops RL algorithms with provable safety guarantee using offline data. Such a guarantee is essential for practical implementation of RL algorithms.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA]  
 
 Appendix: In the following, we first provide several lemmas which are useful for proving our main results. Lemma 3. With probability at least 1 -δ, for any f r ∈ F, f c ∈ G, π ∈ Π and w ∈ W, we haveEQUATIONThe proofs can be found in Lemma 4 in Zhu et al. (2023) . Lemma 4. With probability at least 1 -2δ, for any f r ∈ F, f c ∈ G and π ∈ Π, we haveEQUATIONwhereϵ stat := V max C * ℓ2 log(|F ||G||Π||W |/δ) N + VmaxBw log(|F ||G||Π||W |/δ) N .Proof. Condition on the high probability event in Lemma 3,for any Then we can havef r ∈ F, f c ∈ G, π ∈ Π, define w * π,f = arg max w∈W E µ (π, f r ) = arg max w∈W |E µ [w(s, a)(f r -T π r f r )(s,T µ (π, f r ) -E D (π, f r ) =|E µ [w * π,fr (s, a)(f r -T π r f r )(s, a)]| - 1 N (s,a,r,s ′ ) ŵπ,f (s, a)(f r (s, a) -r -γf ′ r (s ′ , π)) =|E µ [w * π,fr (s, a)(f r -T π r f r )(s, a)]| -|E µ [ ŵπ,fr (s, a)(f r -T π r f r )(s, a)]| + |E µ [ ŵπ,fr (s, a)(f r -T π r f r )(s, a)]| - 1 N (s,a,r,s ′ ) ŵπ,f (s, a)(f r (s, a) -r -γf ′ r (s ′ , π))≥0 -ϵ stat = -ϵ stat , where the inequality is true by using the definition of w * π,fr and Lemma 3. ThusE µ (π, f r ) -ϵ D (π, f r ) =|E µ [w * π,fr (s, a)(f r -T π r f r )(s, a)]| - 1 N (s,a,r,s ′ ) w * π,fr (s, a)(f r (s, a) -r -γf ′ r (s ′ , π)) + 1 N (s,a,r,s ′ ) w * π,fr (s, a)(f r (s, a) -r -γf ′ r (s ′ , π)) - 1 N (s,a,r,s ′ ) ŵπ,fr (s, a)(f r (s, a) -r -γf ′ r (s ′ , π)) ≤ϵ stat The proof for the case |E µ (π, f c ) -E D (π, f c )| ≤ ϵ stat is similar.Lemma 5. (Empirical weighted average Bellman Error) With probability at least 1 -2δ, for any π ∈ Π, we haveEQUATIONwheref π r := arg min fr∈F sup admissible ν ∥f r -T π r f r ∥ 2 2,ν , ∀π ∈ Π f π c := arg min fc∈G sup admissible ν ∥f c -T π c f c ∥ 2 2,ν , ∀π ∈ Π.Proof. Condition on the high probability event in Lemma 4, we haveE µ (π, f π r ) = max w∈W |E µ [w(s, a)((f -T π r f π r )(s, a))]| ≤E µ (π, f π r ) = max w∈W |∥w∥ 2,µ ∥f π -T π r f )(s, a))]| 2,µ ≤C ℓ * 2 √ ϵ 1 ,where the first inequality is true because of Cauchy-Schwarz inequality and the second inequality comes from the definition of f π r and Assumption 3.2, thus we can obtainEQUATION)Following a similar proof we can haveEQUATIONLemma 6. (Performance difference decomposition, restate of Lemma 12 in Cheng et al. ( 2022)) For an arbitrary policy π, π ∈ Π, and f be an arbitrary function over S × A. Then we have,EQUATION)where ⋄ := r or c.Proof. We prove the case when ⋄ := r, the other case is identical. Let R f,π (s, a) := f (s, a) -γE s ′ |(s,a) [f (s ′ , π)] be a virtual reward function for given f and π. According to performance difference lemma (Kakade and Langford, 2002) , We first have that(J r (π) -J r (µ)) =L µ (π, Q π r ) =∆(π) + L µ (π, f ) (∆(π) := L µ (π, Q π r ) -L µ (π, f )) =∆(π) + E µ [f (s, π) -f (s, a)] =∆(π) + (1 -γ)(J R f,π (π) -J R f,π (µ)) =∆(π) + (1 -γ)Q π R f,π (s 0 , π) -E µ [R π,f (s, a)] =∆(π) + (1 -γ)f (s 0 , π) -E µ [R π,f (s, a)],where the last equality is true because thatQ π R f,π (s, a) = (T π R f,π f )(s, a) = R f,π + γE s ′ |(s,a) [f (s ′ , π)] = f (s, a). Thus we haveEQUATION)For the first term, we have(J r (π) -f (d 0 , π)) =(J r (π) -f (s 0 , π)) (deterministic initial state) =J r (π) -E d π [R π,f (s, a)] + E d π [R π,f (s, a)] -f (s 0 , π) =E d π [R(s, a) -R π,f (s, a)] + E d π [f (s, π) -f (s, π)] =E d π [(T π r f -f )(s, a)] + E d π [f (s, π) -f (s, π)],(26) where the second equality is true becauseE d π [R π,f (s, a)] -f (s 0 , π) =E d π f (s, a) -γE s ′ |(s,a) [f (s ′ , π)] -f (s 0 , π) =E d π f (s, π)] - s ∞ t=1 γ t Pr(s t = s|s 0 ∼ d 0 , π)f (s, π(s)) -f (s 0 , π) =E d π f (s, π)] - s ∞ t=0 γ t Pr(s t = s|s 0 ∼ d 0 , π)f (s, π(s)) =E d π f (s, π)] - s,a ∞ t=0 γ t Pr(s t = s, a t = a|s 0 ∼ d 0 , π)f (s, π(s)) =E d π [f (s, π) -f (s, π)].For the second term we haveE µ [R π,f (s, a)] -J r (µ) =E µ [R π,f (s, a) -R(s, a)] =E µ [(f -T π r f )(s, a)].(27) Therefore plugging 26 and ( 27) into Eq. ( 25), we haveJ r (π) -J r (π) =E µ f -T π r (s, a) + E π T π r f -f (s, a) + E π [f (s, π) -f (s, π)] + L µ (π, f ) -L µ (π, Q π r). The proof is completed.Lemma 7. With probability at least 1 -2δ, for any f r ∈ F, f c ∈ G, and π ∈ Π, we have:EQUATION)whereϵ stat := V max C * ℓ2 log(|F ||G||Π||W |/δ) N + VmaxBw log(|F ||G||Π||W |/δ) N . Proof. Recall that E µ [L D (π, f r )] = L µ (π, f ) and |f r (s, π) -f r (s, a)| ≤ V max .For any f r ∈ F, policy π ∈ Π, applying a Hoeffding's inequality and a union bound we can obtain with probability 1 -δ,EQUATION)The inequality for proving the f c , π is the same.B.1 Proof of Theorem 4.1Proof. According to the performance difference lemma (Kakade and Langford, 2002) , we haveEQUATIONwhere the second equality is true because E µ (π, Q π r ) = Êµ (π, Q π c ) = 0 by Assumption 3.2, and the first inequality comes from the selection of f π r and f π c in optimization ( 6). Therefore, we can obtainJ r (π * ) -J r (µ) ≥ L µ (π * , f π * r ) -λ{L µ (π * , f π * c )} + + λ{J c (π * ) -J c (µ)} + ≥ L µ (µ, f µ r ) -λ{L µ (µ, f µ c )} + + λ{J c (π * ) -J c (µ)} + ≥λ{J c (π * ) -J c (µ)} + ≥ 0 (32)andEQUATION)B.2 Proof of Lemma 2Proof. Denote π ref as π. First according to the definition for the no-regret oracle 5.1, we have1 K K k=1 E π [f k r (s, π) -f k r (s, π k ) -λ{f k c (s, π) -f k c (s, π)} + + λ{f k c (s, π k ) -f k c (s, π)} + ] ≤ ϵ π opt (34)Therefore,EQUATIONandEQUATIONWe finish the proof.Theorem (Restate of Theorem 5.2). Under Assumptions 3.2 and 3.6, let the reference policy π ref ∈ Π be any policy satisfying Assumption 3.7, then with probability at least 1 -δ,EQUATION)whereϵ stat := V max C * ℓ2 log(|F ||G||Π||W |/δ) N + VmaxBw log(|F ||G||Π||W |/δ), and π is the policy returned by Algorithm 1 with β = 2 and π ref as input.Proof. Denote π ref as π. According to the definition of π, and Lemma 6 we haveEQUATIONCondition on the high probability event in , we have(I) + (II) ≤ 2E µ (π k , f k r ) ≤ 2E D (π k , f k r ) + 2ϵ stat (40)According to a similar argument as that in the Lemma 13 in Cheng et al. ( 2022), we have thatEQUATIONwheref π r := arg min fr∈F sup admissible ν ∥f r -T π r f r ∥ 2 2,ν , ∀π ∈ Π.By using Lemma 7, we haveEQUATIONThereforeEQUATIONEQUATIONwhere the third inequality holds by the selection of f k r , and the last inequality holds by Lemma 5. Therefore by using Lemma B.2 we obtainEQUATIONFollowing a similar argument, we have thatEQUATIONB.4 Proof of Theorem 5.6Theorem (Restate of Theorem 5.2). Under Assumptions 3.2 and 3.6, let the reference policy π ref ∈ Π be any policy satisfying Assumption 3.7, then with probability at least 1 -δ,EQUATIONwhereϵ stat := V max C * ℓ2 log(|F ||Π||W |/δ) N + VmaxBw log(|F ||Π||W |/δ) N, and π is the policy returned by Algorithm 1 with β ≥ 0 and µ as input.Proof. Following a similar proof in Theorem 5.2. But when the reference policy is the behavior policy, we have (I) + (II) = 0. Therefore we have have(IV) = L µ (π k , f k r ) -L µ (π k , Q π k ) ≤L µ (π k , f k r ) -L µ (π k , Q π k ) + βE D (π k , f k r ) ≤L µ (π k , f k r ) -L µ (π k , Q π k ) + βE D (π k , f k r ) -βE D (π, f π k ) + βC * ℓ2 √ ϵ 1 + βϵ stat (Lemma 5) ≤L D (π k , f k r ) + betaE D (π k , f k r ) -L D (π k , f π k r ) -βE D (π, f π k ) + (β + 1)(ϵ stat + C * ℓ2 √ ϵ 1 ) ≤(β + 1)(ϵ stat + C * ℓ2 √ ϵ 1 ).We finish the proof.To extract the behavior policy when it is not provided, we can simply run behavior cloning on the offline data. In particular, we can estimate the learned behavior policy πµ as follows: ∀s ∈ D, πµ (a|s) ← n(s,a) n(s) , and ∀s / ∈ D, πµ (a|s) ← 1 |A| , where n(s, a) is the number of times (s, a) appears in the offline dataset D. Essentially, the estimated BC policy matches the empirical behavior policy on states in the offline dataset and takes uniform random actions outside the support of the dataset. It is easy to show that the gap between the learned policy πµ and the behavior policy π µ is upper bounded by O(min{1, |S|/N }) (Kumar et al., 2022; Rajaraman et al., 2020) . We can have a very accurate estimate as long as the size of the dataset is large enough.The practical version of our algorithm WSAC is shown in Algorithm 2.1: Input: Batch data D, policy network π, network for the reward critic f r , network for the cost critic f c , β > 0, λ > 0. 2: for k = 1, 2, . . . , K do 3:Sample minibatch D mini from the dataset D.Update Critic Networks:l reward (f r ) := L Dmini (π, f r ) + βE Dmini (π, f r ), f r ← ADAM(f r -η fast ∇l reward (f r )), l cost (f c ) := -λL Dmini (π, f c ) + βE Dmini (π, f c ), f c ← ADAM(f c -η fast ∇l cost (f c )).Update Policy Network:l actor (π) := -L mini (π, f r ) + λ{L mini (π, f c )} + , π ← ADAM(π -η slow ∇l actor (π)).6: end for 7: Output: πBesides the "BallCircle" environment, we also study several representative environments as follows.All of them are shown in Figure 2 and their offline dataset is from Liu et al. (2023a) . • CarCircle: This environment requires the car to move on a circle in a clockwise direction within the safety zone defined by the boundaries. The car is a four-wheeled agent based on MIT's race car. The reward is dense and increases by the car's velocity and by the proximity towards the boundary of the circle and the cost is incurred if the agent leaves the safety zone defined by the two yellow boundaries, which are the same as "CarCircle". • PointButton: This environment requires the point to navigate to the goal button location and touch the right goal button while avoiding more gremlins and hazards. The point has two actuators, one for rotation and the other for forward/backward movement. The reward consists of two parts, indicating the distance between the agent and the goal and if the agent reaches the goal button and touches it. The cost will be incurred if the agent enters the hazardous areas, contacts the gremlins, or presses the wrong button. • PointPush: This environment requires the point to push a box to reach the goal while circumventing hazards and pillars. The objects are in 2D planes and the point is the same as "PointButton". It has a small square in front of it, which makes it easier to determine the orientation visually and also helps point push the box.We run all the experiments with NVIDIA GeForce RTX 3080 Ti 8-Core Processor.The normalized reward and cost are summarized as follows:EQUATIONEQUATIONwhere r(M) is the empirical reward for task M, κ is the cost threshold, ϵ is a small number to ensure numerical stability. Thus any normalized cost below 1 is considered as safe. We use R π and C π to dentoe the cumulative rewards and cost for the evaluated policy, respectively. The parameters of r min (M), r max (M) and κ are environment-dependent constants and the specific values can be found in the Appendix D. We remark that the normalized reward and cost only used for demonstrating the performance purpose and are not used in the training process. The detailed value of the reward and costs can be found in Table 3 . To mitigate the risk of unsafe scenarios, we introduce a hyperparameter We use different β for the reward and cost critic networks and different U B Q C for the actor-network to make the adversarial training more stable. We also let the key parameter λ within a certain range balance reward and cost during the training process. Their values are shown in Table 3 . In experiments, we take W = {0, C ∞ } for computation effective. Then we can reduceE D (π, f ) to C ∞ E D [(f (s, a) -r -γf (s ′ , π)) 2 ] and reduce ÊD (π, f ) to C ∞ E D [(f (s, a) -c -γf (s ′ , π)) 2 ].In this case, C ∞ can be considered as a part of the hyperparameter β r (β c ).The evaluation performances of the agents in each environment after 30000 update steps of training are shown in Table 2 , and the performance of average rewards and costs are shown in Figure 3 . From the results, we observe that WSAC achieves a best reward performance with significantly lowest costs against all the baselines. It suggests WSAC can establish a safe and efficient policy and achieve a steady improvement by leveraging the offline dataset.To further evaluate the performance of our algorithm under varying situations. We further compare our algorithm with baselines under varying cost limits, we report the average performance of our method and other baselines in Table 4 . Specifically, cost limits of [10, 20, 40] are used for the BallCircle and CarCircle environments, and [20, 40, 80] for the PointButton and PointPush environments, following the standard setup outlined by Liu et al. (2023a) . Our results demonstrate that WSAC maintains safety across all environments, and its performance is either comparable to or superior to the best baseline in each case. These suggest that WSAC is well-suited for adapting to tasks of varying difficulty. To investigate the contribution of each component of our algorithm, including the weighted Bellman regularizer, the aggression-limited objective, and the no-regret policy optimization (which together guarantee our theoretical results), we performed an ablation study in the tabular setting. The results, presented in Table 5 , indicate that the weighted Bellman regularization ensures the safety of the algorithm, while the aggression-limited objective fine-tunes the algorithm to achieve higher rewards without compromising safety. We provide the rewards and costs under different sets of β r = β c ∈ {1, 0.5, 0.05} and λ ∈ {[0, 1], [0, 2], [1, 2]} (since our λ only increases, the closed interval here represents the initial value and the upper bound of λ) to demonstrate the robustness of our approach in the tabular setting in Figure 4 . We can observe that the performance is almost the same under different sets of parameters and different qualities of behavior policies.• If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not. • If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable. • Depending on the contribution, reproducibility can be accomplished in various ways.For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed. (d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility.In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results. 


Decision: This paper introduces an approach for safe offline reinforcement learning (RL), by introducing Weighted Safe Actor-Critic (WSAC), which incorporates pessimistic bias through a weighted average Bellman error and theoretical guarantees. The efficacy of WSAC is demonstrated across four benchmark environments: BallCircle, CarCircle, PointButton, and PointPush; the results are promising. Although the work seems to be a little bit similar to ATAC, the reviewers overall all recommend acceptance as the work is both theoretically grounded and practically significant.

Reviews: review: paper_summary: paper_summary: This paper introduces a principled approach for safe offline reinforcement learning (RL), aimed at robustly optimizing policies beyond a given reference policy, particularly when constrained by the limited data coverage of offline datasets.
The traditional constrained actor-critic methods face challenges including (1) coping with insufficient data coverage, (2) ensuring robust policy improvement, and (3) facilitating computationally efficient actor optimization.
To address these limitations, this study presents the Weighted Safe Actor-Critic (WSAC) framework. WSAC incorporates (1) a pessimistic bias through a weighted average Bellman error, (2) theoretical assurances for robust policy improvement, and (3) an efficiency advantage over traditional primal-dual optimization methods.
WSAC employs an aggression-limited objective function, which discourages unsafe policies, relying on less stringent assumptions compared to prior methodologies. Furthermore, WSAC leverages the reference policy as a no-regret policy optimization oracle, allowing for safe policy training.
The efficacy of WSAC is demonstrated across four benchmark environments: BallCircle, CarCircle, PointButton, and PointPush. The results indicate that WSAC effectively optimizes policies to maximize cumulative rewards while maintaining cumulative costs below predefined thresholds.
strength_weakness: strength_weakness: The proposed Weighted Safe Actor-Critic (WSAC) method in this submission is contingent upon the availability of an explicit reference policy, such as a behavior policy derived from the offline dataset. 
This requirement could make training difficult in scenarios where extracting a reliable reference policy from the offline data is challenging, particularly for algorithms aiming to be behavior-agnostic in offline RL settings.

Additionally, the authors claim in line 239 that "Our approach is very computationally efficient and tractable compared with existing approaches." However, the absence of empirical evidence, such as wall-clock time comparisons, to substantiate this claim weakens their argument. 
Providing such comparative data would significantly strengthen their case for computational efficiency.

Moreover, the paper does not include ablation studies to elucidate the contributions of the three key components of WSAC: (1) weighted Bellman error, (2) aggression-limited objective, and (3) no-regret policy optimization using a single reference policy. Identifying which of these components is most critical to performance enhancement would provide clearer insights into the framework's effectiveness and areas for potential improvement.
questions: questions: Q1.  Could you elaborate on the sensitivity of the hyperparameters such as $\beta_c$, $\beta_r$, $\lambda$? Understanding their influence on the model's performance and robustness would be beneficial, especially in varying training conditions.

(Minor Comments)

1. In obj 2, the Bellman error coefficients $\beta$ used in the reward and cost constraints appear to have different values, indicated by $\beta_c, \beta_r$. To avoid confusion, it would be prudent to denote these coefficients separately throughout the manuscript to reflect their distinct roles and values.

2. The typo in line 231 : "WSAC sovles" →  "WSAC solves."
limitations: limitations: The authors addressed their limitations in Section 4 and Conclusion and the broader societal impact in Checklist #10: Broader Impacts.
paper_summary: paper_summary: This paper proposes weighted safe actor-critic, and provides corresponding theoretical analysis on its optimal statistical rate. Some interesting technical tools were introduced. The authors also implement a practical version of WSAC and evaluate it against SOTA offline safe RL baselines in continuous control tasks.
strength_weakness: strength_weakness: See more discussion in the question parts.
questions: questions: (1) **Clarification of "Adversarial"**: I'd like to have a clarification of the term "adversarial" in this offline safe RL problem. Do the authors mean "adversarial" in that the cost critic always update cost critic via optimism and reward critic via pessimism? Since there are other formats of adversarial robustness in other components of safe RL [1], I may be helpful if the authors could clarify it in the early stage of this paper. 

(2) **Finite selection of W**: the current WSAC algorithm prototype only considers a discrete selection of $w$, can they be arbitrarily assigned for different offline datasets and environments? Intuitively if an arbitrary $w$ is close enough to its neighbor $w$ in set $\mathcal{W}$, we can still provide analytical bound of performance under slightly different $w$. 

(3) **Lack of discussion of assumption gap in the pratical version**: the authors may describe how certain assumptions may not hold in practice, as they are some seemingly relatively strong assumptions in the theoretical analysis, like approximate realizability, though some of them have already got loosened. Also, some experiment details (e.g. the behavior policy or the oracle policy) can be discussed in the appendix to provide more contexts in how WSAC can help practically. 

(4) **Capability under sparse-cost setting**:  in many real-world applications, safety violations will occur only in long-tail events. Can the reweighting scheme also address such long-tail cases in the cost critic learning?  Can the current WSAC framework can be extended for this kind of analysis based on the weighting technique? 

(5) **Extension of the current framework to multi-constraint settings**: in real-world applications, there might be multiple objectives and constraints, can the WSAC framework adapt to similar settings? 

(6) **Selection of weight W in the experiments**: Compared to algorithm 1, the practical implementation of WSAC seems to miss $\mathcal{W}$, how is this importance weight computed in practice? 


> [1] Liu, Zuxin, et al. "On the robustness of safe reinforcement learning under observational perturbations." *arXiv preprint arXiv:2205.14691* (2022).
limitations: limitations: The authors have clearly defined the scope and discussed the limitations of this paper.
paper_summary: paper_summary: For safe RL methods, a desired property is Safe Robust Policy Improvement(SRPI), which means the learned policy is always at least as good and safe as the baseline behavior policies. But it's not achieved yet.

Also, the traditional Actor-Critic framework may suffer from insufficient data coverage, which may fail to provide an accurate estimation of the policy for unseen states and actions. To address the issue, [45] and [11] use absolute pessimism or relative pessimism. However, his kind of approach fails to achieve the optimal statistical rate of $\sqrt{N}$. For addressing efficient policy improvement, the most commonly used approach for addressing safe RL problems is primal-dual optimization, but this method requires all policy concentrability, that is, the dataset must cover all possible strategies, which is impractical for the safe-related dataset.

In contrast, the authors propose an aggression-limited objective function,  the high-level intuition behind it is that by appropriately selecting a 𝜆,  all unsafe policies are penalized.  As a result, the policy that maximizes the objective function is the optimal safe policy. This formulation is fundamentally different from the traditional primal-dual approach as it does not require dual-variable tuning, and thus, does not require all policy concentrability.

Beyond that, the proposed method also proved to achieve SRPI.

[45] Tengyang Xie, Ching-An Cheng, Nan Jiang, Paul Mineiro, and Alekh Agarwal. Bellman-consistent pessimism for offline reinforcement learning.

[11]Ching-An Cheng, Tengyang Xie, Nan Jiang, and Alekh Agarwal. Adversarially trained actor critic for offline reinforcement learning
strength_weakness: strength_weakness: 1. In this paper's setting, safety is measured purely by cost, which is not always practical. e.g. in the real world, the cost function could be implicit or impossible to get.  

2. The authors could try to combine the proposed method with other RL methods for a certain application to further justify its effectiveness.
questions: questions: The paper looks good. And there is a suggestion for future directions.

Bridge the gap between theory and practice. Current RL methods have some bottlenecks like long-horizon tasks, safety, sample efficiency, etc.. Most of the methods to solve these bottlenecks come out of intuition instead of theory deduction. And some methods leverage external tools like foundation models(e.g. LLM), and control theories. It might be interesting to explain why these intuition or external tools work in view of theories.
limitations: limitations: The authors did not provide limitations.

A possible limitation may come from the experiment on PointPush, in which the simple BC's reward outperformance proposed method without sacrificing too much safety.  

And as stated in weakness, safety is expressed purely by the cost function, which sometimes is hard to get in the real world.
paper_summary: paper_summary: The Weighted Safe Actor-Critic (WSAC) is a new Safe Offline Reinforcement Learning algorithm designed to outperform any reference policy while ensuring safety with limited data. It uses a two-player Stackelberg game to achieve optimal convergence and safe policy improvements. In practical tests, WSAC surpasses baselines in continuous control environments.
strength_weakness: strength_weakness: - Given that I haven't examined the mathematical details, I find that many of the assumptions and proofs of key theorems in the paper resemble those in ATAC [1]. The primary differences are the authors' focus on the safe offline RL setting and the inclusion of a cost value in their theory. However, the use of a primal-dual approach in the algorithm's implementation may introduce training stability issues [2]. From both theoretical and practical implementation perspectives, it is difficult to identify novel insights in the paper.
- The author needs to compare more state-of-the-art baselines, such as CDT [3] and FISOR [2].
- Line 34 contains a duplicate citation.

[1] Cheng, Ching-An, et al. "Adversarially trained actor critic for offline reinforcement learning." *International Conference on Machine Learning*. PMLR, 2022.

[2] Zheng, Yinan, et al. "Safe offline reinforcement learning with feasibility-guided diffusion model". *International Conference on Learning Representations* (2024).

[3] Liu, Zuxin, et al. "Constrained decision transformer for offline safe reinforcement learning." *International Conference on Machine Learning*. PMLR, 2023.
questions: questions: - What about the performance under different cost limits? The average cost in Table 2 does not adequately reveal the safety of the algorithm.
limitations: limitations: n/a

Comments: comment: Thank you very much again for your great comments and for taking the time to engage with us. We sincerely appreciate your acknowledgment and positive feedback on our work!
Thank you very much for your acknowledgment and your positive feedback on our work!
I thank the authors for their extensive replies. Also, I read the discussion between the authors and reviewer HDvF. I think most of my questions have been well-addressed with the clarification of their theoretical contribution and the new empirical evidence. I will raise my score to 6 in favor of the acceptance.
Thanks for increasing your score and engaging with us. 

> Technical Differences with ATAC
ATAC is the first paper in the literature to investigate the property of RPI. While we certainly draw insights from their results, our work has the following significant differences.

- First, we focus on the **constrained Markov decision process (CMDP)** setup rather than an unconstrained setup. The CMDP setup is fundamentally different from the unconstrained one. For example, in CMDP, the optimal policy can be stochastic, unlike in the unconstrained MDP. In the constrained setup, it is essential to bound both the sub-optimality of the reward and the constraint violation, whereas, in the unconstrained setup, only the sub-optimality of the reward needs to be bounded. Naturally, the analytical results and algorithms differ significantly from those in the unconstrained ATAC setup.

- Furthermore, our approach to training the critics is different from that of ATAC. ATAC uses a squared Bellman error, while we utilize the average Bellman error to train the critic. Consequently, we achieve a $1/\sqrt{N}$ sample complexity error, while ATAC achieves a $1/N^{1/3}$ sample complexity error. The key difference is that we use an importance-weighted Bellman error to obtain an unbiased estimator of the critic for both the reward and cost, tuning the weight parameter to achieve a better rate, unlike ATAC.

- Moreover, while primal-dual-based methods exist for solving the offline CMDP, achieving robust safe policy improvement and relaxing the assumption of all-policy concentrability remained open challenges (Table 1 in our paper). We resolved this open question. Our approach guarantees robust policy improvement, so if a safe reference policy (e.g., a safe behavioral policy) is provided, our algorithm will yield a policy that remains safe without sacrificing reward. Such a guarantee was previously missing from the literature. As pointed out in the introduction, **all-policy** concentrability is difficult to satisfy in practice, especially in a safe setting where the dataset may not cover state-action pairs from an unsafe policy. Instead, we only require single-policy concentrability, making our theoretical results highly impactful for the safe RL community.

- We consider a policy improvement over **any reference policy** not only the behavior policy.

- It is worth noting that to provide such a guarantee, we developed a rectified penalty-based approach rather than a primal-dual-based one. As a result, our analysis differs from existing primal-dual approaches. In fact, the existing primal-dual-based approaches only guarantee all-policy concentrability, so our analytical insights and proposed approach open new avenues for finding a safe policy from an offline dataset.

> compare with the SOTA baselines

it is crucial to compare with the state-of-the-art (SOTA) baselines to demonstrate the strength of our proposed approach. Therefore, we compare our practical version with existing approaches on selected benchmarks. As requested by the reviewer, we have included results from CDT in our rebuttal. We apologize for not making this clearer earlier. Notably, ours is the only approach that achieves safety, underscoring the efficacy of our method. Additionally, CDT uses a transformer architecture, which naturally results in a longer computational time compared to our [approach](https://openreview.net/forum?id=82Ndsr4OS6&noteId=VR6S2gv84s).

 Finally, we would like to mention that in safe RL, there are two types of constraints: soft constraints (in the long-term average sense) and hard constraints (step-wise). It is difficult to say which one is more important because, in the long-term average case, taking some risk is necessary; otherwise, the problem would be no different from an unconstrained problem. Moreover, the existing solutions in theoretical safe RL for addressing these two types of constraints are significantly different. We agree that the cost limits are chosen by humans, and we appreciate the reviewer pointing out that a fairer comparison should consider different sets of cost limits. We observe that there is a trend: the reward increases when the cost limit is higher. To understand the differences between two settings, we can also observe that as reported in the FISOR paper, some environments (e.g., SwimmerVel, CarButton1, CarGoal2) exhibit very low or even negative rewards because they aim to learn very safe policies. We will definitely add more discussion in the final revision.

We are also happy to learn more about the reviewer's opinion on selecting the cost limits. What we typically do is to make sure the problem itself is feasible and the optimal solution is stochastic in synthetic CMDPs and follow what people use (like OSRL and other baselines) in complicated environments.

**We hope that our response addresses the concerns of the reviewer and is open to further discussion. Thank you again for raising the score!**
After considering the positive feedback provided by other reviewers on the theoretical aspects, I will increase the score from 3 to 5. However, I still think that the main proof core and the concept of safe policy improvement primarily originate from ATAC. I suggest that other reviewers might want to further compare the theoretical aspects of ATAC with those presented in this paper.

Cheng, Ching-An, et al. "Adversarially trained actor critic for offline reinforcement learning." International Conference on Machine Learning. PMLR, 2022.

Additionally, concerning the algorithm's performance on benchmarks and the selection of baselines, I think it would be prudent to include more advanced state-of-the-art approaches. After all, CPQ and Copitidice are articles from 2022, and bcql and bearl come from earlier offline RL algorithms. Regarding the recently well-performing algorithms like CDT and FISOR, it would be beneficial for the author to explore or discuss the feasibility of transitioning the WSAC theoretical framework to SOTA.

Regarding the issue of non-comparison due to different settings mentioned by the author, it's noteworthy that while CDT requires the introduction of additional information such as target reward and target cost, the baseline in the paper, including WSAC, also necessitates a human-defined cost limit. For FISOR, since safety is a key goal in safe RL research, it doesn't make sense to say that stricter safety constraints stop us from comparing safety between different algorithms.
Thank you for the response! And it helps me keep a positive opinion of this work, so I would maintain my score.
We greatly thank the reviewer for considering reevaluating our paper and for raising these two interesting questions.

>Extracting the Behavior Policy

In the standard offline RL setting, we assume that the dataset is generated by some behavior policy $\mu(s,a)$ and is i.i.d. Therefore, as long as the state-action space is finite, the method we provided guarantees that we can accurately estimate the behavior policy. This holds true whether we are considering safe RL or regular RL, as the only difference is the additional information regarding the cost function, while the process of generating the dataset remains the same.

For more complicated cases, such as when the state space is continuous, we can use a neural network to approximate the policy by minimizing the distance between the learned policy and the behavior policy. Alternatively, we could use DAgger (Dataset Aggregation) to achieve an even better policy. However, in such cases, the assumptions made in offline RL (not only in our paper but in the field generally) may no longer hold, particularly the data/policy coverage assumption. This is why we argue in our paper that single-policy coverage is crucial since it is much weaker than the full-policy coverage assumption.

>extended to the non-tabular cases

 There seems to be some confusion. We consider the function approximation setting, not a tabular setting, and the theoretical results are independent of the size of the state and action space under the given assumptions. The practical version of our algorithm is designed to develop a deep neural network approach for more complex environments. In order to handle the continuous state and action spaces, we use an actor-critic approach to solve the optimization problem (2), which aligns with the objective in our theoretical version. Specifically, we can use the aggression-limited objective to train the actor-network, which is feasible by considering two Q-value neural networks (one for reward and one for cost). The method used in our practical version for the weighted Bellman regularizer is a very simplified version. However, we believe it is possible to approximate $w(s,a)$ with another neural network such that the weighted Bellman error is minimized when the critic network is fixed. We will add more discussions and possibly some results in the revision.

Please let us know if you have further questions and comments, we are glad to have more discussions.
We thank the reviewer again for the positive evaluation of our paper. We provide the error bars in the following tables.

|                    | BEARL  | CPQ    | CDT    | COptiDICE | WSAC   |
|--------------------|--------|--------|--------|-----------|--------|
| **Time (seconds)** | 120.0  | 113.8  | 464.6  | 112.0     | 116.40 |
| **STD**            | 1.41   | 2.13   | 1.62   | 5.05      | 1.85   |
| **Confidence Interval** | (116.07, 123.93) | (107.88, 119.37) | (460.09, 469.11) | (97.95, 126.05) | (111.25, 121.55) |

**Table 1:** Training Time (seconds) for 200 steps over 5 repeat experiments


| Components                                                        | Cost  | Reward | Cost STD | Reward STD | Cost Interval    | Reward Interval    |
|-------------------------------------------------------------------|-------|--------|----------|------------|------------------|--------------------|
| **ALL**                                                           | 0.014 | 0.788  | 0.006    | 0.004      | (0.00, 0.03)     | (0.78, 0.80)       |
| **W/O no-regret policy optimization**   | 0.014 | 0.788  | 0.006    | 0.004      | (0.000, 0.028)   | (0.779, 0.798)     |
| **W/O Aggression-limited objective**  | 0.014 | 0.788  | 0.006    | 0.005      | (0.000, 0.028)   | (0.778, 0.798)     |
| **W/O Weighted Bellman regularizer**  | 0.323 | 0.684  | 0.061    | 0.017      | (0.185, 0.462)   | (0.645, 0.724)     |

**Table 2:** Ablation study under tabular case (cost limit is 0.1) over 10 repeat experiments
I thank the authors for their detailed response, especially their justification of the assumption. One clarification question on the statement: " The behavior policy is easy to achieve, even if it is not given to us, since extracting the behavior policy from an offline dataset is not difficult with behavior cloning (BC)." Since the example you provided is using pure tabular case, which is even weaker than your assumption (discrete action space + complex state space). How do you justify the difficulty of behavior policy extraction given the safety constraints in offline safe RL? 

Another follow-up question about the gap between theoretical assumptions and their empirical practicability is that most OSRL baselines have continuous action and continuous state space, and the authors propose a practical version of WSAC in the appendix. I'm curious about whether the authors can provide some insights on how the current theoretical guarantees can be extended to the non-tabular cases, if applicable. 

Besides the above two questions, most of the other questions are well-addressed by the author's response. I thank the authors again for their dedicated efforts and will determine my final score after this round of discussion.
> Averaging the number of safety constraint violations 

**There seems to be some confusion.** In our paper, we used a single cost limit (thus, there was no point in taking an average) similar to what the baselines (CDT, COptiDICE, CPQ) did in their original papers. The average is taken over different random seeds, but we used  **a single cost limit**. We believe that the results over different random seeds in Table 2 can correctly reflect the true performance of our approach. From Table 2, it is clear for the single cost limit, our approach is the *only one* that can satisfy the constraints across different benchmarks.

During the rebuttal phase, per the reviewer's request, we ran the algorithm with different cost limits following the exact format used in the Offline Safe RL Benchmark (OSRL) paper, where they report the average across performance with different cost limits. It is clear that our algorithm performs well, as no other algorithms are consistently safe, in terms of average performance. To further address the reviewer’s concern, we report individual results with different cost limits under our algorithm in the following table, where our algorithm achieves very low costs and high safety rates and is nearly safe for all environments. Note that due to time constraints in the rebuttal phase, we did not perform any parameter tuning, and we believe we can further improve the performance (both in terms of reward and safety) if we do so. Note that, we can't compare with other baselines since the OSRL paper doesn't have the results for different cost limits (they only have the average results). We also believe that although one of our main contributions is [theoretical](https://openreview.net/forum?id=82Ndsr4OS6&noteId=fBIu70VHUw), our approach with theoretical support is quite general and has the potential to be incorporated into other practical Safe-RL algorithms. 

| | Reward ↑ | Cost ↓ | Reward ↑ | Cost ↓ | Reward ↑ | Cost ↓ |
|-------------|----------|--------|----------|--------|----------|--------|
|     Cost Limit          | 10       |        | 20       |        | 40       |        |
| BallCircle  | 0.71     | 0.10   | 0.76     | 1.17   | 0.75     | 0.27   |
| CarCircle   | 0.60     | 0.07   | 0.67     | 0.99   | 0.68     | 0.59   |

|  | Reward ↑ | Cost ↓ | Reward ↑ | Cost ↓ | Reward ↑ | Cost ↓ |
|-------------|----------|--------|----------|--------|----------|--------|
|      Cost Limit        | 20       |        | 40       |        | 80       |        |
| PointButton | 0.01     | 0.47   | 0.13     | 0.67   | 0.18     | 0.51   |
| PointPush   | 0.10     | 1.11   | 0.07     | 0.52   | 0.05     | 0.21   |

**Table 1: The normalized reward and cost of WSAC for different cost limits.  Each value is averaged over 20 evaluation episodes, and 3 random seeds.**

>  limited subset of environments 

We focus on environments where most (if not all) baselines are unsafe (e.g., no baselines are safe in PointButton, and only BCQL is safe in PointPush). Yet, we show that our proposed approach can achieve safety while maintaining good reward which points towards its efficacy.  We believe these environments are both challenging and representative, effectively justifying an algorithm's ability to guarantee safety.

We would like to emphasize that our main contribution in this paper is to address the Safe Robust Policy Iteration (SRPI) and policy coverage limitations in theoretical offline safe RL which are quite important in the theoretical safe-RL community (see Table 1). For example, none of the existing approaches (including the baselines) have a **safe robust policy improvement guarantee** using only a *single policy coverage assumption*. In particular, our approach provides a way to achieve a safe policy using only offline data with bare minimum richness (single policy coverability). Existing approaches that are based on primal-dual concept require more richness in data (all policy concentrability which is not possible to achieve in practice). Please see Table 1 and discussion in Introduction. Furthermore, the baselines do not provide any theoretical guarantees, since they aim to design practical algorithms. To demonstrate the empirical efficiency of our approach, we included four challenging environments in our paper. We agree that running the algorithm on all 38 environments in the baseline Safe RL paper would surely have values, and we will try to evaluate our approach on more baselines in the final version.  However, we believe that the environments we selected are sufficient to demonstrate the core ideas of our paper and validate the theoretical insights. Even the state-of-the-art algorithms  (without theoretical guarantees) only include a limited number of representative environments in their papers; for instance, CDT has 5, CPQ has 3, and COptiDICE has 4.

We sincerely hope that the reviewer will reevaluate the rating based on the novel contributions of our paper.
Thank you for your response. The evaluation of safety should focus on whether the algorithm can still ensure safety under a single cost limit. Averaging the number of safety constraint violations across multiple cost limits does not accurately represent the policy's safety, as exceeding the cost limit in practical applications can result in unsafe outcomes. It would be better if the author could separately present the model's performance under different cost limits to demonstrate the safety guarantees provided by their theoretical approach. Furthermore, the author has selected only a very limited subset of environments in OSRL for comparison (4 out of 38 environments), which does not sufficiently demonstrate the algorithm's advantages over the baseline. Based on these points, I maintain my current score.
Thank you for addressing my concerns. It would be beneficial if the authors could report the error bars (e.g., standard errors or confidence intervals) of the computational cost and results of the ablation study in the revision. 

I still believe this paper makes sufficient contributions to the offline RL community, so I will be maintaining my rating.