{"id":"https://openalex.org/W7150885060","doi":"https://doi.org/10.48550/arxiv.2604.02686","title":"Beyond Semantic Manipulation: Token-Space Attacks on Reward Models","display_name":"Beyond Semantic Manipulation: Token-Space Attacks on Reward Models","publication_year":2026,"publication_date":"2026-04-03","ids":{"openalex":"https://openalex.org/W7150885060","doi":"https://doi.org/10.48550/arxiv.2604.02686"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.02686","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.02686","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.02686","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133062537","display_name":"Yuheng Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Yuheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133033646","display_name":"Mingyue Huo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Huo, Mingyue","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081357837","display_name":"Minghao Zhu","orcid":"https://orcid.org/0000-0001-6922-2056"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhu, Minghao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133030887","display_name":"Mengxue Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Mengxue","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5133049048","display_name":"Nan Jiang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiang, Nan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9710000157356262,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9710000157356262,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.0031999999191612005,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10462","display_name":"Reinforcement Learning in Robotics","score":0.002099999925121665,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.745199978351593},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.7148000001907349},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6639000177383423},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.4537000060081482},{"id":"https://openalex.org/keywords/ambiguity","display_name":"Ambiguity","score":0.43479999899864197},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.40299999713897705}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.745199978351593},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7283999919891357},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.7148000001907349},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6639000177383423},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.4537000060081482},{"id":"https://openalex.org/C2780522230","wikidata":"https://www.wikidata.org/wiki/Q1140419","display_name":"Ambiguity","level":2,"score":0.43479999899864197},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.40400001406669617},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.40299999713897705},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.38760000467300415},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3276999890804291},{"id":"https://openalex.org/C204806902","wikidata":"https://www.wikidata.org/wiki/Q2333581","display_name":"Semantic security","level":5,"score":0.2775000035762787},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.26440000534057617}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.02686","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.02686","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.02686","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.02686","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.578182578086853,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Reward":[0],"models":[1],"(RMs)":[2],"are":[3],"widely":[4],"used":[5],"as":[6],"optimization":[7,58],"targets":[8],"in":[9,60,159],"reinforcement":[10],"learning":[11],"from":[12],"human":[13],"feedback":[14],"(RLHF),":[15],"yet":[16],"they":[17],"remain":[18],"vulnerable":[19],"to":[20,81],"reward":[21,74,120],"hacking.":[22],"Existing":[23],"attacks":[24],"mainly":[25],"operate":[26],"within":[27],"the":[28,65,70,73,78,119,136,151],"semantic":[29,152],"space,":[30],"constructing":[31],"human-readable":[32],"adversarial":[33,57],"outputs":[34,138],"that":[35,55,103,144],"exploit":[36],"RM":[37],"biases.":[38],"In":[39],"this":[40],"work,":[41],"we":[42],"introduce":[43],"a":[44,53,156],"fundamentally":[45],"different":[46],"paradigm:":[47],"Token":[48],"Mapping":[49],"Perturbation":[50],"Attack":[51],"(TOMPA),":[52],"framework":[54],"performs":[56],"directly":[59],"token":[61,85,101],"space.":[62],"By":[63],"bypassing":[64],"standard":[66],"decode-re-tokenize":[67],"interface":[68],"between":[69],"policy":[71,80],"and":[72,125,154],"model,":[75],"TOMPA":[76,97,116],"enables":[77],"attack":[79],"optimize":[82],"over":[83],"raw":[84],"sequences":[86],"rather":[87],"than":[88],"coherent":[89],"natural":[90],"language.":[91],"Using":[92],"only":[93],"black-box":[94],"scalar":[95],"feedback,":[96],"automatically":[98],"discovers":[99],"non-linguistic":[100],"patterns":[102],"elicit":[104],"extremely":[105],"high":[106,134],"rewards":[107],"across":[108],"multiple":[109],"state-of-the-art":[110],"RMs.":[111],"Specifically,":[112],"when":[113],"targeting":[114],"Skywork-Reward-V2-Llama-3.1-8B,":[115],"nearly":[117],"doubles":[118],"of":[121,130],"GPT-5":[122],"reference":[123],"answers":[124],"outperforms":[126],"them":[127],"on":[128],"98.0%":[129],"prompts.":[131],"Despite":[132],"these":[133],"scores,":[135],"generated":[137],"degenerate":[139],"into":[140],"nonsensical":[141],"text,":[142],"revealing":[143],"RMs":[145],"can":[146],"be":[147],"systematically":[148],"exploited":[149],"beyond":[150],"regime":[153],"exposing":[155],"critical":[157],"vulnerability":[158],"current":[160],"RLHF":[161],"pipelines.":[162]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-07T00:00:00"}