Online Reward Poisoning in Reinforcement Learning With Convergence Guarantee

This paper studies the online reward poisoning problem, wherein an adversary deliberately manipulates the reward function during training to mislead the learning agent into adopting a mischievous policy. While the majority of existing reward poisoning research focuses on offline attacks, which assume prior knowledge of the transition probability, our work explores a more practical yet challenging dynamics-agnostic scenario. Specifically, we consider the scenario where the adversary has access to the agent’s replay buffer and can modify the reward data without the knowledge of transition probabilities. We formalize the poisoning task as an optimization problem and employ a reformulation method to circumvent the double-sampling issue. The proposed algorithm is provably convergent in the tabular setting and can be extended to the function approximation setting, where the poisoned reward network and the poisoned Q-value network are jointly learned to solve the problem. The algorithm’s effectiveness is validated through four distinct experimental evaluations.