What it is
Two linked confidentiality risks: (a) stealing or extracting the policy — model theft, query-based extraction, inversion, membership inference — which also enables white-box action attacks; and (b) the robot as a persistent surveillance device, covertly or by design harvesting its rich multimodal stream (video, audio, LiDAR, maps).
A stolen policy is permanent leverage; a robot’s data stream is among the most sensitive that exists — inside homes, factories, and secure sites — and bystanders never consented.
Seen in the wild
The Unitree G1 was found streaming telemetry to servers in China roughly every 5 minutes without notification (arXiv:2509.14096), a case cited at the U.S. Senate. Model extraction and inversion of learned policies are documented (DRL policy stealing; SoK, arXiv:2606.16788). NIST makes confidentiality/privacy one of its three core attack goals. Provael performs no real exfiltration — its “canaries” are opaque sim markers.
Attack, measure, prove
- Ships the `confidentiality` family (membership_inference + model_extraction) as a pre-deployment screen for a memorized training canary: `membership_inference` probes whether a candidate canary was a training member; `model_extraction` queries the policy to reproduce it.
- Each is injected as a sim-only probe while the visible instruction stays benign, and scored as a leak rate with a 95% Wilson CI against a benign-FPR control. Provael performs no real exfiltration — the canaries are opaque sim markers scored on a deterministic fixture.
- Stub-validated only (the CPU fixture memorized a planted canary → the screen fires 100% [84–100%] vs a 0% benign baseline); a clean policy that memorized no such canary screens ~0% — an honest null. Real SmolVLA×LIBERO transfer (an actual membership-inference / extraction advantage from querying a real policy, never exfiltrating real data) is GPU-gated and not yet run — no cross-model claim.
What reduces the risk
- Egress monitoring and allow-lists; rate-limit and obfuscate query APIs.
- Watermark / fingerprint weights; minimize and disclose telemetry; prefer on-device processing.
- Data-residency controls and a bystander-privacy review.
How it shows up in CI
Every finding for this risk carries a stable rule id in the SARIF report — the Embodied AI Top-10 id itself:
Crosswalk
- OWASP
- LLM02 Sensitive Information Disclosure
- MITRE ATLAS
- Exfiltration → model extraction / membership inference via the inference API
- Frameworks
- NIST AI 100-2 — Privacy (model extraction, NISTAML.03)
See the full framework crosswalk for dates and detail. Not legal advice.