Executive Summary

Key Figures

Source: Yuqiao Xu, Erman Ayday, Seeing Less Is Not Seeing Safely: Privacy Leakage from Task-Scoped Robot Perception Exports, arXiv:2609.03055v1 (2026-09-02)

Robot privacy research has long looked at the sensor end. Blur the camera, mask sensitive objects, process the RGB stream locally and discard it. What this paper aims at is the next step along. It is the moment when the maps, free-space structures, object geometry, and target references that a robot builds after perception leave the robot. The authors place a representation-export boundary at that point and propose a frame in which whatever crosses it should be assembled to carry only what the task needs. They call it Task-Functional Perception Distillation, or TFPD.

The threat model is set conservatively. The adversary sees the entire public representation that crossed the boundary. The authors conservatively assume the adversary also knows the schema of that representation, the downstream task, and the public transformation used to construct it. Any service that legitimately consumes the export has to understand the interface, and a service that grows curious or gets breached ends up holding the same knowledge. It is also a statement that TFPD does not rely on keeping the representation format or transformation secret. On the other side of the line, the raw sensor stream and the fields that stay local are out of the adversary's reach, and the local perception stack itself is treated as trusted.

What crosses the boundary is profiled along three axes. Task utility asks whether the work still gets done with that representation. Direct exposure records what was explicitly exported. Residual inference measures what can be recovered from the remaining structure even though it was never explicitly exported. Residual inference splits into five channels: room inference, private-object inference, object-category inference that recovers semantic categories from anonymous or coarsened geometry, scene linkability that matches a representation to the corresponding scene in a gallery, and target-category inference that recovers the semantic category of an object-goal target. Keeping those five as a vector instead of collapsing them into one score is the most practical decision in the paper, and the results below explain why.

The paper is equally clear about what it is not doing. TFPD does not protect against compromise of the trusted local perception stack, and it provides no formal guarantee that exported representations reveal no private information. Measured attack performance characterizes residual leakage under the evaluated adversaries rather than an upper bound on all possible inference. It introduces no new planner and no new collision-checking algorithm, and it performs no adaptive runtime selection among candidate representations. Human-robot interaction channels such as raw audio, speaker identity, speech transcripts, and conversational history are outside the scope of the work entirely. What this article covers is one strand: the representations built by seeing and interpreting a home.

The stage is the full set of 120 household scenes in AI2-THOR, split scene-disjointly into 80 training, 20 validation, and 20 held-out test scenes. The validation and test sets each contain five scenes from each of the four room families. No house appears in both training and test. Attack models are trained on the training data, selected on validation, and then frozen before they touch the test set. Navigation utility comes from 50 deterministic start-goal trials per held-out scene, which is 1,000 trials across the 20 scenes.

The navigation task compared three ways of exporting free space. Metric free space exports absolute coordinates as they are. Normalized free space normalizes those coordinates and keeps only relative geometry and connectivity. Topological free space drops coordinates and distances altogether and exports a connectivity graph of nodes and edges. Their driving records did not separate. All three reached success 1.000, path feasibility 1.000, and a mean path ratio of 0.898, with zero planning failures. Judged by the evaluated navigation criteria, these three are fully interchangeable designs.

Exposure was another matter. Top-1 scene linkability came out at 0.970 for metric free space, 0.782 for topological, and 0.532 for normalized. With 20 gallery identities, random Top-1 accuracy is 0.050, so all three sit far above chance. Among them the normalized export is 43.8 percentage points below the metric one. Normalizing the coordinates once brought it down that far, and it cost nothing in the evaluated navigation utility.

Linkability, as it is measured here, covers less ground than the word suggests. The number comes from an experiment that matches a query, derived from a controlled perturbation of the same underlying export, against a gallery. It does not match observations independently recaptured on a separate visit. The authors flag this in their limitations and write that it should not be interpreted as real-world home re-identification. So this number should not be restated as a home having been pinned down. What it measures is how easy a scene is to single out, and among designs with the same driving record that ease varied by close to a factor of two.

It is easy to assume that erasing more information makes a representation safer. The topological export throws away coordinates, absolute scale, and edge distances alike. The normalized export keeps relative geometric structure. By sheer volume erased, topological erases more. Yet in the AI2-THOR experiment all three attacks ordered the same way. Normalized sits lowest, topological next, and metric highest.

Room inference macro-F1 was 0.479 for normalized, 0.558 for topological, and 0.736 for metric. Against a most-frequent-class baseline of 0.100, all three leave a substantial amount of room information behind. Private-object inference was 0.412 for normalized, 0.567 for topological, and 0.928 for metric, and normalized is the only one whose point estimate does not exceed the 0.444 baseline. The authors do not treat that ordering as settled, though. Because the attribute-inference confidence intervals overlap, they state plainly that this is an observed point-estimate ordering rather than a formal pairwise significance result.

Run the same experiment on a different scene distribution and the ordering does not hold. Repeating the protocol on a fixed set of 120 ProcTHOR-10K houses for another 1,000 held-out trials, the three representations again reached success 1.000, path feasibility 1.000, and an identical mean path ratio of 0.879. The task stays equivalent. Linkability came out at 1.000 for metric, 0.573 for normalized, and 0.497 for topological. Only the fact that metric is the most exposed carries over, and the order of normalized and topological reverses. The confidence intervals of those two reversed values overlap, and on that basis the authors decline to interpret the three-way ordering in either distribution as a universal property of representation abstraction. The replication does not install a corrected ordering. All that becomes clear is that an ordering cannot serve as a design rationale.

ProcTHOR is not independent validation. It runs on the AI2-THOR execution engine, which is why the authors call it a cross-distribution replication rather than validation in an independent simulator. What does come through is that which representation is safer depends on the structure of the environment. No rule about one representation being universally better can be drawn from this experiment. That is what the paper's title says. Seeing less is not seeing safely.

The object-goal task has a different structure. Inside the protected local boundary the robot first settles what the target is, and what leaves is only a reference pointing at that already-settled target. How to write the reference is the design choice. Five reference schemes went into the comparison: the target label as it is, a target coordinate, a target region, an anonymous target ID, and a planning-graph node.

All five reached the same task success of 0.995. Target-category inference did not stay together. The table below holds both the split and the two channels that never split.

Read only the three left-hand columns and it looks like a clean win. Replacing the target's name with a region alone dropped target-category inference from 1.000 to 0.077, and the robot's record for reaching its target stayed at 0.995. The planning-graph node goes lower still, at 0.053. Since the baseline is 0.00482, though, neither of them fell all the way to nothing. The authors write that the transformed references do not eliminate residual target-semantic inference under the evaluated attacks.

The two right-hand columns are the real lesson of this experiment. Room inference is 0.644 for all five schemes, and private-object inference is 0.913 for all five. However the target reference was rewritten, these two channels did not budge. What the target was is now hidden, but which room the home is in and whether it holds privacy-sensitive objects still read out. The design decision from section 1, keeping residual risk as a vector instead of one score, earns its keep right here. Averaged into a single number, this table would have looked like an improvement.

These findings reach as far as the evaluated object-goal criterion and no further. The authors are explicit that they do not imply the five target references are interchangeable for subsequent manipulation or grasping tasks. Picking an object up calls for additional pose, orientation, or grasp-relevant geometry, and once that information rides along, the exposure calculation starts over.

The third task, collision checking, went in yet another direction. Inside the local boundary the structural elements are filtered out, namely Floor, Wall, Ceiling, Window, and LightSwitch, and the remaining obstacles are exported as nothing but the centers and sizes of axis-aligned bounding boxes. Semantic labels, object identities, and orientation are not exported. Even so, that anonymous exact geometry alone yielded an object-category inference macro-F1 of 0.704. The evaluation runs over 848 held-out object records, with 92 categories frozen as eligible before test evaluation and 90 of them occurring in the held-out labels. The most-frequent-class baseline is 0.00160. Strip the name tag and the size and position of a box still say a good deal about what it is.

So the authors tried blurring the geometry. Coarsening rounds every component of the centers and sizes to one decimal place. Object-category inference fell to 0.556. That much was expected. The cost and the side effect arrived together. Collision-checking F1 dropped from 1.000 to 0.950, room inference stayed at 1.000 both before and after, and private-object inference rose from 0.844 to 0.928. On those three results the authors state that they do not interpret coarsening as a general privacy improvement.

Line the three tasks up and the same shape repeats. Utility metrics fail to separate the design choices, and privacy metrics move in different directions channel by channel. Fixing one channel does not lift the whole, and a more abstract representation is not reliably safer. Which representation is safe therefore cannot be settled by a rule fixed in advance, and the paper concludes that there is no alternative to measuring multiple risks separately for each task.

Read by someone who designs physical AI data pipelines, three questions are left over. The three below are not in the paper. They are what comes up when you move what the paper measured onto a pipeline of your own.

• Is there a written list of the fields our robot exports to planners, to the cloud, and to logs? When that list was decided, was the rationale performance, or was exposure measured separately and then decided?
• If exposure is measured, how many channels does it cover? Collapse them into one score and an improved channel hides an unchanged one, exactly as the target region case in this paper did.
• Does the attack model we use actually read the full representation that gets published? For 26 of 33 combinations it did not, and that single difference separated 0.405 from 0.928.

• 1.Xu, Y., Ayday, E. (2026). "Seeing Less Is Not Seeing Safely: Privacy Leakage from Task-Scoped Robot Perception Exports." arXiv:2609.03055v1. — Case Western Reserve University, the TFPD (Task-Functional Perception Distillation) framework and the AI2-THOR/ProcTHOR experiments.