Policy Reconstruction in RL

• Policy Reconstruction is a set of adversarial techniques that use inverse RL to infer unknown reward functions from deployed RL policies.
• It quantifies reconstruction error using metrics like L1, L2, L∞ distances, demonstrating that standard DP methods may not effectively protect sensitive rewards.
• Empirical studies reveal that despite tighter privacy budgets, even DP-enhanced RL methods can leak reward details, urging the need for new privacy-centric mechanisms.

Policy reconstruction refers to adversarial techniques for extracting or estimating characteristics of an unknown reward function underlying a published or deployed reinforcement learning (RL) policy. In privacy-sensitive settings such as autonomous driving or recommendation systems, policies trained by RL may implicitly encode private preferences or objectives. "How Private Is Your RL Policy? An Inverse RL Based Analysis Framework" (Prakash et al., 2021) introduces a systematic framework—Privacy-Aware Inverse RL (PRIL)—that formalizes and operationalizes reward-reconstruction attacks against privacy-preserving RL policies. By quantifying the fidelity of reward recovery via inverse RL, the framework exposes substantial gaps between standard differential privacy guarantees applied to policy-training mechanisms and the effective protection of sensitive reward functions.

1. Formalization of the Reward-Reconstruction Attack

The PRIL framework defines the reward-reconstruction attack as an adversarial process: given a deployed RL policy $\pi$ trained on an unknown reward function $R : S \to \mathbb{R}$, an adversary applies inverse RL to infer a reconstructed reward $\hat R$. The framework evaluates both non-private policies ($\pi'$) and differentially-private policies ($\pi''$), measuring privacy via a set of reward-distance metrics between $R$ and the recovered $\hat R$:

• Non-private baseline: $\pi'$ trained directly on $R$.
• Private policy: $\pi''$ trained on $R : S \to \mathbb{R}$0 with a chosen differential privacy (DP) mechanism.

The attack pipeline is:

1. Apply inverse RL to $R : S \to \mathbb{R}$1 to obtain $R : S \to \mathbb{R}$2.
2. Apply inverse RL to $R : S \to \mathbb{R}$3 to obtain $R : S \to \mathbb{R}$4.
3. Compute distances $R : S \to \mathbb{R}$5 and $R : S \to \mathbb{R}$6 using several metrics.
4. If $R : S \to \mathbb{R}$7 is large, the private policy $R : S \to \mathbb{R}$8 offers strong reward privacy. Otherwise, $R : S \to \mathbb{R}$9 is vulnerable to reconstruction.

2. Inverse RL Algorithm: Finite-State LP Formulation

Reward reconstruction leverages the classical finite-state Inverse RL algorithm of Ng and Russell (2000), instantiated as a linear program (LP) that finds the minimum-norm reward vector $\hat R$0 making the input policy $\hat R$1 uniquely optimal by at least a margin of 1. The optimization is:

• Objective:

$\hat R$2

• Optimality-by-margin constraints (for every state $\hat R$3 and every action $\hat R$4):

$\hat R$5

where

$\hat R$6

$\hat R$7

The full LP can be written as:

$\hat R$8

The LP returns $\hat R$9 as the reconstructed reward vector consistent with policy $\pi'$0.

3. Differential Privacy in RL Algorithms

Three major classes of DP mechanisms are evaluated in PRIL:

• Value Iteration + DP-Bellman (VI-DP-Bellman):
  • Gaussian noise $\pi'$1 is added to each Bellman update:

  $\pi'$2 - Sensitivity for the update is $\pi'$3. - Rényi-DP theory dictates:

  $\pi'$4

• Deep Q Network (DQN): DP-SGD, DP-Adam, DP-Shoe, DP-FN:

  • DP-SGD/Adam/Shoe: per-example gradients are clipped to norm $\pi'$5 and Gaussian noise $\pi'$6 is added.
  • DP-Shoe uses SGD + tanh activations; DP-SGD/DP-Adam use ReLU.
  • DP-FN: functional Gaussian process noise is added directly to Q-value estimates, ensuring $\pi'$7-DP.
• Proximal Policy Optimization (PPO):
  • Only the actor network updates are privatized using DP-SGD, DP-Adam, or DP-Shoe.
  • Critic updates remain non-private.
  • The same gradient clipping and Gaussian noise are applied as in DQN.

Privacy parameters in experiments:

• $\pi'$8
• $\pi'$9
• $\pi''$0 is computed using TensorFlow-Privacy’s RDP-to-DP conversion.

4. Quantitative Reward-Distance Metrics

PRIL assesses reconstruction error with four metrics, operating on reward vectors $\pi''$1 and $\pi''$2 (normalized):

Metric	Formula	Description
$\pi''$3 distance	$\pi''$4	Total variation
$\pi''$5 distance	$\pi''$6	Euclidean error
$\pi''$7 distance	$\pi''$8	Maximum deviation
Sign-change count	$\pi''$9	Reward sign flips across states

These metrics directly quantify the adversary’s ability to reconstruct the true underlying reward.

5. Empirical Evaluation: FrozenLake Benchmarks and Results

Experiments are carried out on 24 customized FrozenLake domains (12 of $R$0 and 12 of $R$1 grids), featuring cell types: Safe (S), Frozen (F), Hole (H), High-reward (A), and Goal (G), with near-deterministic transitions (slip factor $R$2).

• Algorithms Evaluated: VI-DP-Bellman, DQN-DP-SGD, DQN-DP-Shoe, DQN-DP-Adam, DQN-DP-FN, PPO-DP-SGD, PPO-DP-Shoe, PPO-DP-Adam, plus non-private baselines.
• Training Protocols: DQN/PPO use 15 epochs, 200 iterations, batch size 50, micro-batches 5, learning rate 0.15, discount $R$3. VI runs Bellman updates until convergence.

Policy extraction and reward reconstruction are performed for each $R$4 and algorithm over 10 random seeds. Distances $R$5, $R$6, $R$7, and $R$8 are computed.

Key findings:

• All four reconstruction error metrics are flat as a function of $R$9: increasing the privacy budget does not substantially decrease $\hat R$0.
• Aggregated $\hat R$1 error ranks: DQN-variants $\hat R$2 PPO-variants $\hat R$3 VI-DP-Bellman. E.g., $\hat R$4 (DQN), $\hat R$5 (PPO), $\hat R$6 (VI-DP-Bellman) for $\hat R$7 environments.
• The utility–privacy trade-off is present for policy returns (lower $\hat R$8 reduces return), but reward reconstruction error remains insensitive to $\hat R$9.

6. Privacy-Gap Analysis and Implications

A fundamental insight is that differential privacy mechanisms protecting policy updates—such as per-iteration gradient noise or DP-Bellman—do not guarantee privacy for the underlying reward function. Inverse RL attacks in PRIL can reconstruct $\pi'$0 from $\pi'$1 with a small, constant error substantially independent of $\pi'$2. Classical non-deep methods (VI-DP-Bellman) provide less reward privacy than deep RL approaches (DQN/PPO), yet the improvement is insufficient for privacy-critical domains.

This suggests a significant mismatch between the theoretical privacy guarantees (in terms of $\pi'$3-DP applied during training) and the protection actually required to conceal the true reward. A plausible implication is that future DP-RL research must either develop reward-centric privacy mechanisms—directly privatizing $\pi'$4—or redefine DP guarantees to explicitly bound reward-reconstruction error under adversarial inverse RL.

7. Summary and Directions

PRIL provides a rigorous framework for adversarial assessment of reward privacy in RL. It leverages finite-state LP inverse RL to reconstruct the reward from policies trained under various DP mechanisms and quantifies the privacy leakage via multiple reward-distance metrics. Empirical results clearly indicate a gap: prevailing DP-RL techniques do not prevent effective reward reconstruction, exposing the need for fundamentally stronger privacy definitions and mechanisms in RL policy deployment (Prakash et al., 2021).