Trustworthy AI-Driven Dynamic Hybrid RIS: Joint Optimization and Reward Poisoning-Resilient Control in Cognitive MISO Networks

Deemah H. Tashman; Soumaya Cherkaoui

cs.NIMar 27, 2026

Trustworthy AI-Driven Dynamic Hybrid RIS: Joint Optimization and Reward Poisoning-Resilient Control in Cognitive MISO Networks

Authors: Deemah H. Tashman, Soumaya Cherkaoui

Organizations: LINCS Laboratory, Department of Computer and Software Engineering, Polytechnique Montréal, Montréal, QC, Canada, H3T 1J4

Abstract

Cognitive radio networks (CRNs) are a key mechanism for alleviating spectrum scarcity by enabling secondary users (SUs) to opportunistically access licensed frequency bands without harmful interference to primary users (PUs). To address unreliable direct SU links and energy constraints common in next-generation wireless networks, this work introduces an adaptive, energy-aware hybrid reconfigurable intelligent surface (RIS) for underlay multiple-input single-output (MISO) CRNs. Distinct from prior approaches relying on static RIS architectures, our proposed RIS dynamically alternates between passive and active operation modes in real time according to harvested energy availability. We also model our scenario under practical hardware impairments and cascaded fading channels. We formulate and solve a joint transmit beamforming and RIS phase optimization problem via the soft actor-critic (SAC) deep reinforcement learning (DRL) method, leveraging its robustness in continuous and highly dynamic environments. Notably, we conduct the first systematic study of reward poisoning attacks on DRL agents in RIS-enhanced CRNs, and propose a lightweight, real-time defense based on reward clipping and statistical anomaly filtering. Numerical results demonstrate that the SAC-based approach consistently outperforms established DRL baselines, and that the dynamic hybrid RIS strikes a superior trade-off between throughput and energy consumption compared to fully passive and fully active alternatives. We further show the effectiveness of our defense in maintaining SU performance even under adversarial conditions. Our results advance the practical and secure deployment of RIS-assisted CRNs, and highlight crucial design insights for energy-constrained wireless systems.

Figures & tables

Ref.	RIS Mode	Energy Adaptation	Channel/ Hardware	RL Security	DRL
[ 20 , 21 , 22 ]	Fixed hybrid	No	Ideal/ideal	No	DDPG/DPG
[ 9 , 15 , 16 , 17 , 18 ]	Passive	No	Ideal/ideal	No	DDPG/SAC
[ 19 ]	Active	No	Ideal/ideal	No	DDPG/TD3
Ours	Dynamic hybrid	Yes	Cascaded /non-ideal	Yes	SAC

Table I: Comparison of Closely Related Works

Symbol	Definition
$A$	Number of antennas at SU Transmitter
$B$	Number of SU Receivers
$R$	Number of RIS reflecting elements
$W$	Number of PU receivers
$\mathbf{H_{s}}$	SU transmitter and RIS link channel matrix
$\mathbf{h_{b}}$	RIS and SU receivers channel vector

Table II: List of Main Symbols

Defense Type	Computational Cost	Ease of Integration	Ref.
Clipping + Statistics	Minimal	Very easy	Ours
Multi-env Training	High	Moderate	[ 23 ]
Provable Robust Optimization	Very High	Difficult	[ 24 ]
Bandit Game Defense	Moderate	Moderate	[ 25 ]
Certified Offline RL	Very High	Difficult	[ 26 ]

Table III: Comparison of Reward Poisoning Defense Strategies

Figure 2: SUs’ sum rate for different RIS reflecting elements $(R)$ . $A=4$ , $B=4$ , $P_{t}=30$ dB, $I=20$ dB, and $\kappa_{s}=1$ , $\kappa_{b}=1$ .

Figure 3: SUs’ sum rate for different cascade levels $(\kappa)$ , SU transmitter antennas ( $A$ ), and SU receivers $(B)$ . $R=30$ , $P_{t}=30$ dB, $I=20$ dB, and $\kappa_{s}=\kappa_{b}=\kappa$ .

Figure 4: SUs’ average rate (reward) for different values of the RIS minimum reflection amplitude $(\beta_{m})$ and the maximum transmission power available at the SU transmitter $(P_{t})$ . $\kappa_{s}=\kappa_{b}=1$ , and $I=20$ dB.

Figure 5: A comparison between the SUs’ average rate for the SAC, TD3, DDPG, and Random policies. $P_{t}=1$ dB, $\kappa_{s}=\kappa_{b}=1$ , $I=1$ dB, and $\beta_{m}=0.6$ .

Figure 6: SUs’ average reward (rate) for different number of PU receivers $(W)$ for the SAC and DDPG policies. $P_{t}=30$ dB, $\kappa_{s}=\kappa_{b}=\kappa$ , and $I=10$ dB.

Figure 7: A Comparison of SUs average rate for passive, active, and dynamic hybrid RIS at varying $\tau$ .

Figure 8: A comparison between the passive and active mode usage in hybrid RIS system.

Figure 9: A comparison between the dynamic hybrid RIS and fixed hybrid RIS. $\tau=20$ Joules, $P_{t}=30$ dB, $I=20$ dB, and $\kappa_{s}=\kappa_{b}=2$ .

$\tau$ (J)	Hybrid (J)	Active (J)	Energy Savings (%)
50	0.092	0.356	74.2%
40	0.148	0.343	56.8%
30	0.226	0.354	36.3%
10	0.306	0.352	13.1%

Table IV: Average Energy Consumption Comparison.

Figure 10: A trade-off between energy consumption and performance (average converged rate) for the fully active and hybrid RIS for different values of $\tau$ . $P_{t}=30$ dB, $I=10$ dB, and $\kappa_{s}=\kappa_{b}=2$ .

Figure 11: The SUs’ average rate for the invert and scale poisoning attacks for different values of the reward threshold $(A_{T})$ and the scaling factor $(S_{C})$ . $\tau=30$ Joules, $P_{t}=30$ dB, $I=20$ dB, and $\kappa_{s}=\kappa_{b}=2$ .

Figure 12: Impact of the defense mechanism on the invert poisoning attack. $\tau=30$ Joules, $P_{t}=30$ dB, $I=20$ dB, $A_{T}=0.5$ , and $\kappa_{s}=\kappa_{b}=2$ .

Wireless Communications

Wireless communications studies how information is sent over radio links and how networks manage signals, spectrum, and resources reliably.

See all 391 papers

When Critics Disagree: Adaptive Reward Poisoning Attacks in RIS-Aided Wireless Control System
May 19, 2026Deemah H. Tashman, Soumaya CherkaouiWireless Communications Robust RL
Department of Computer and Software Engineering, Polytechnique Montreal, Montreal, Canada
Active Sensing for RIS-Aided Tracking and Power Control: A Hybrid Neuroevolution and Supervised Learning Approach
Jun 30, 2026George Stamatelis, Hui Chen, Henk Henk Wymeersch +1Reconfigurable Intelligent Surfaces Active Sensing
Department of Informatics and Telecommunications, National and Kapodistrian University of Athens, Panepistimiopolis Ilissia, 16122 Athens, Greece · Department of Electrical Engineering, Chalmers University of Technology, 412 58 Gothenburg, Sweden
Bypassing the CSI Bottleneck: MARL-Driven Spatial Control for Reflector Arrays
Apr 6, 2026Hieu Le, Oguz Bedir, Mostafa Ibrahim +2Wireless Communications Reconfigurable Intelligent Surfaces
Electrical and Computer Engineering, Texas A&M University, College Station, Texas, USA · Engineering Technology and Industrial Distribution, Texas A&M University, College Station, Texas, USA · School of Performance, Visualization, and Fine Arts, Texas A&M University, College Station, Texas, USA +1

May 19, 2026J/K move · Enter open · S save

When Critics Disagree: Adaptive Reward Poisoning Attacks in RIS-Aided Wireless Control System

Deemah H. Tashman, Soumaya Cherkaoui

Department of Computer and Software Engineering, Polytechnique Montreal, Montreal, Canada

Wireless Communications Robust RL

Open paper AskPDF arXiv

Reward-poisoning attacks present a significant risk to learning-based wireless control systems. Given this, we propose a Disagreement-Guided Reward Poisoning (DGRP) adaptive attack on a Soft Actor-Critic (SAC) agent. In a Cognitive Radio Network (CRN) environment assisted by Reconfigurable Intelligent Surfaces (RIS), the SAC agent is tasked with maximizing the long-term secondary users' (SUs) rate by simultaneously optimizing the transmission power of the SU transmitter and the RIS phase shifts. DGRP corrupts rewards, particularly when the SAC dual critics exhibit substantial disagreement-especially in high-leverage, high-uncertainty states-resulting in distorted value estimations and guiding the policy towards suboptimal actions. Our findings demonstrate that DGRP substantially diminishes the performance improvements typically provided by RIS and degrades transmission quality. We further investigate key attack parameters and determine their impact on learning. In comparison to periodic-timing and exploration-triggered baselines, DGRP consistently causes greater damage, highlighting the necessity of considering disagreement-aware threats when evaluating the robustness of Deep Reinforcement Learning (DRL) in RIS-assisted networks.

Abstract

Wireless Communications

Explore similar work

When Critics Disagree: Adaptive Reward Poisoning Attacks in RIS-Aided Wireless Control System

Active Sensing for RIS-Aided Tracking and Power Control: A Hybrid Neuroevolution and Supervised Learning Approach

Bypassing the CSI Bottleneck: MARL-Driven Spatial Control for Reflector Arrays