论文/arXiv 2609.03055·1 个月前

少看并不等于安全地看：任务范围机器人感知导出的隐私泄露

针对家用机器人结构化感知导出的隐私泄露，提出TFPD按任务评估导出，并在AI2-THOR与ProcTHOR任务中验证。

AI 整理

• 感知与导航
• 端侧部署
• 评测与安全

原文链接：Seeing Less Is Not Seeing Safely: Privacy Leakage from Task-Scoped Robot Perception Exports（arXiv 2609.03055 · 发布日期：2026-09-02）

Seeing Less Is Not Seeing Safely: Privacy Leakage from Task-Scoped Robot Perception Exports

针对家用机器人结构化感知导出的隐私泄露，提出TFPD按任务评估导出，并在AI2-THOR与ProcTHOR任务中验证。

核心要点

• 即使原始传感器数据留在本地，下游导出的结构化表示仍可能泄露家庭信息。
• TFPD将丰富感知保留在本地，并按任务效用、直接暴露和残余推断风险刻画导出。
• 在120个AI2-THOR场景评估导航、碰撞检查和目标物体执行，显示任务等价不代表隐私等价。
• ProcTHOR复现保留导航发现，但不同导出排序变化，说明抽象程度不存在通用隐私排序。

验证范围与局限：验证范围为AI2-THOR和ProcTHOR场景中的导航、碰撞检查与目标物体执行任务。

英文摘要 (Abstract)

Domestic robots rely on rich perception to operate in private homes, but privacy risk persists even when raw sensor data remain local. Structured representations exported to downstream planners, cloud services, logs, or learning pipelines can still reveal household information through semantics, geometry, spatial structure, and task targets. We introduce Task-Functional Perception Distillation (TFPD), a task-scoped representation-export framework that keeps rich perception local and profiles downstream exports according to task utility, direct exposure, and multiple residual inference risks. Using 120 AI2-THOR scenes with scene-disjoint train/validation/test splits, frozen attacker selection, and representation-aware held-out attacks, we evaluate navigation, collision checking, and object-goal execution. Three navigation exports achieve identical success (1.000) and mean path ratio (0.898), yet representation-level linkability ranges from 0.532 to 0.970. Replacing an explicit target label with a target region reduces target-category macro-F1 from 1.000 to 0.077 while preserving success at 0.995, while geometric coarsening reduces object-category macro-F1 from 0.704 to 0.556 at a measurable collision-utility cost. A ProcTHOR replication preserves the navigation task-equivalence/privacy-inequivalence finding while changing the relative ordering of normalized and topological exports. These results show that neither field removal nor stronger abstraction induces a universal privacy ordering and motivate task-specific, multi-risk evaluation of the complete public representation.

作者：Yuqiao Xu, Erman Ayday

来源

本页事实对应的公开页面，以原文为准。

1. arXiv 2609.03055：Seeing Less Is Not Seeing Safely: Privacy Leakage from Task-Scoped Robot Perception Exports访问 2026-10-21