Saved in:
| Main Authors: | , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2604.10062 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866915937633959936 |
|---|---|
| author | Escamilla, Jose Efraim Aguilar Hong, Haoyang Li, Jiawei Zhao, Haoyu Zhang, Xuezhou Hong, Sanghyun Wang, Huazheng |
| author_facet | Escamilla, Jose Efraim Aguilar Hong, Haoyang Li, Jiawei Zhao, Haoyu Zhang, Xuezhou Hong, Sanghyun Wang, Huazheng |
| contents | We study reward poisoning attacks in reinforcement learning (RL), where an adversary manipulates rewards within constrained budgets to force the target RL agent to adopt a policy that aligns with the attacker's objectives. Prior works on reward poisoning mainly focused on sufficient conditions to design a successful attacker, while only a few studies discussed the infeasibility of targeted attacks. This paper provides the first precise necessity and sufficiency characterization of the attackability of a linear MDP under reward poisoning attacks. Our characterization draws a bright line between the vulnerable RL instances, and the intrinsically robust ones which cannot be attacked without large costs even running vanilla non-robust RL algorithms. Our theory extends beyond linear MDPs -- by approximating deep RL environments as linear MDPs, we show that our theoretical framework effectively distinguishes the attackability and efficiently attacks the vulnerable ones, demonstrating both the theoretical and practical significance of our characterization. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2604_10062 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | When Can You Poison Rewards? A Tight Characterization of Reward Poisoning in Linear MDPs Escamilla, Jose Efraim Aguilar Hong, Haoyang Li, Jiawei Zhao, Haoyu Zhang, Xuezhou Hong, Sanghyun Wang, Huazheng Machine Learning We study reward poisoning attacks in reinforcement learning (RL), where an adversary manipulates rewards within constrained budgets to force the target RL agent to adopt a policy that aligns with the attacker's objectives. Prior works on reward poisoning mainly focused on sufficient conditions to design a successful attacker, while only a few studies discussed the infeasibility of targeted attacks. This paper provides the first precise necessity and sufficiency characterization of the attackability of a linear MDP under reward poisoning attacks. Our characterization draws a bright line between the vulnerable RL instances, and the intrinsically robust ones which cannot be attacked without large costs even running vanilla non-robust RL algorithms. Our theory extends beyond linear MDPs -- by approximating deep RL environments as linear MDPs, we show that our theoretical framework effectively distinguishes the attackability and efficiently attacks the vulnerable ones, demonstrating both the theoretical and practical significance of our characterization. |
| title | When Can You Poison Rewards? A Tight Characterization of Reward Poisoning in Linear MDPs |
| topic | Machine Learning |
| url | https://arxiv.org/abs/2604.10062 |