TRACE: Reconstructing Private Robot Trajectories from Policy Gradients in Embodied RL
具身強化學習的隱私危機：TRACE 演算法僅憑「策略梯度」即可重建機器人私密軌跡
While federated embodied RL assumes privacy by keeping raw sensor data local and uploading only policy gradients, this paper introduces TRACE (Temporal Reconstruction Attack on Consecutive Encodings). TRACE exploits cross-time correlations and policy-head gradient structures to autoregressively reconstruct sequential observations and actions. It achieves 18.8 dB PSNR with near-perfect action recovery, taking just 3-4.5 ms per frame. This reveals a critical vulnerability in sequential gradient sharing, calling for sequence-aware defenses.
Key points
Exploiting Temporal Correlation
Unlike single-frame attacks, TRACE exploits cross-time correlation between consecutive gradients, formalized via a conditional mutual-information bound.
Exact Action Recovery
Proves that agent actions can be exactly recovered in closed form from the policy-head gradient structure when entropy regularization is small.
High-speed and High-fidelity
Reconstructs each frame in just 3 to 4.5 ms while achieving 18.8 dB PSNR, outperforming traditional optimization-based and learning-based baselines.
Broad Generalizability
Demonstrates robust performance across various victim architectures, including recurrent, residual, and compact transformer models, as well as multi-modal inputs.
How it works
Why it matters
This research shatters the common assumption that local gradient-sharing guarantees privacy in distributed learning. In sequential domains like embodied AI (e.g., smart home robots, autonomous vehicles), temporal correlations are highly informative. TRACE highlights an urgent need for sequence-aware privacy-preserving mechanisms, such as temporal differential privacy, to protect physical environment trajectories from being reconstructed.
Who it affects
- AI Developer
- AI Researcher
- Enterprise Leader
- Policy Maker
How to use it
- 1Evaluating privacy vulnerabilities of embodied agents (e.g., vacuum robots, smart cameras) in federated or distributed training settings.
- 2Serving as a benchmark to test new sequence-aware defense mechanisms and differential privacy techniques.
Limitations & caveats
- The exact closed-form action recovery depends on low entropy regularization; larger regularization coefficients may degrade recovery accuracy.
- The attack relies on consecutive temporal gradients; aggressive gradient pruning or highly sparse update intervals might mitigate its effectiveness.
Related
LLM Agents Can Easily Tamper with Their Own Traces: A Critical Security Flaw in Agent Frameworks
LLM Agent 可輕易篡改自身執行軌跡：現行代理框架的重大安全漏洞
Researchers reveal that popular LLM agent frameworks fail to protect execution traces from being tampered with or deleted by the agents themselves, posing significant risks for compliance and safety monitoring.
The Invisible Trap: How Natural Context Can Easily Flip AI Decision Models
語言中的隱形陷阱：自然脈絡如何輕易誘騙 AI 決策模型
This study exposes a critical vulnerability in AI decision models: adding short, natural-looking context without altering the underlying question can easily trick models like Jev into making high-confidence wrong choices.
Google Advances Private AI Compute with Secure, Server-Side Memory
Google 發表 Private AI Compute 記憶技術：實現跨裝置 AI 助理與終端級隱私
Google DeepMind's update to Private AI Compute enables persistent, cross-device AI memory by combining secure cloud enclaves with keys stored solely on user devices.