Source-linked AI summary
Remotely Detectable Keyed Communication through Motion
Benjamin Chang, Michael Amir, Manon Flageat, Amanda Prorok
TL;DR
Robots’ motion could carry messages detectable remotely, but communication must preserve task behavior while accommodating keyed recovery and the constraints of sensing motion. MTM encodes symbols as keyed noise in pre-trained policies and decodes them from remote observations; the paper reports recovery across simulations and on real robots, alongside design trade-offs and scope limits.
Problem
The paper studies how to transmit arbitrary short messages through robot motion detectable by remote sensors without degrading policy performance or requiring a direct wireless link.
Source: §1 · pp. 1–2Method
MTM maps message symbols to keyed noise signals in a pre-trained stochastic policy’s action-noise channel and decodes them from remote motion observations.
Source: §5 · p. 5, §5.2 · p. 5, §7 · p. 9Results
Across four simulated domains and RoboMaster, MTM carried message content at little cost to behavior, though Football scoring fell from 1.00 to 0.90.
Source: §7 · p. 9Takeaways & Limitations
Larger alphabets reduce transmission time, redundant same-message encoding improves robustness, and channel reliability can vary substantially.
Source: §7 · p. 9Hardware decoding uses motion capture, so performance on real, uncalibrated RGB video and under occlusion remains untested.
Source: §8 · p. 9
Abstract
from arXiv · showhide
Messages from electronic devices are conventionally received as text, audio, or radio signals. But robots move with rich, articulate motion in the real world, opening up the possibility of transmitting messages through motion itself. In this paper, we consider the problem of motion-based communication, where we seek to modify a robot's movements so as to transmit messages detectable from remote sensing (e.g., video or motion capture), without degrading policy performance. We introduce a method for messaging through motion capable of encoding arbitrary message content over short payloads - such as an agent's current intent - as noise in any pre-trained policy's actions. This brings a new kind of robustness to robot communication: this 'physical' channel complements standard wireless communications channels but does not depend on them, requiring no extra hardware nor the establishment of a direct link to the robot. We systematically characterize the space of encoding schemes and derive design heuristics, then validate them across simulated environments and real-robot deployment; on real robots running at 50 Hz, four robots jointly recover an 8-bit message at an aggregate 0.67 bits/s.
1 Introduction
The paper proposes a keyed channel that carries arbitrary short messages in robot motion, recoverable from remote sensing without altering the task policy. It develops encoding choices and evaluates message recovery in simulation and on hardware.
1 Introduction
- Only a recipient with the shared key is intended to recover message content; unkeyed observers decode symbols at or near chance in evaluated null conditions, but watermark presence is not hidden.Source: §1 · p. 2
- For Gaussian policies, shaping existing noise preserves the marginal action distribution, a guarantee MTM inherits from prior work.For deterministic policies, the method instead injects a small Gaussian perturbation, with the performance-detectability trade-off controlled by its amplitude.Source: §1 · p. 2
- MTM embeds keyed messages in the action-noise channel of pre-trained stochastic policies at inference time, with recovery from passive remote observations.The paper also states that its approach requires no retraining, architectural changes, or extra hardware.Source: §1 · pp. 2–3
- MTM extends a remotely detectable single-watermark primitive into a multi-symbol channel by mapping message symbols to keyed signals decoded from video-derived motion traces.The method targets arbitrary short messages embedded in robot motion.Source: §1 · pp. 2–3
- The design-space analysis formalizes trade-offs among alphabet size, symbol duration, and channel allocation to choose the fastest scheme meeting a decoding-accuracy target.Source: §1 · p. 3
- 100% message recovery in simulation; on hardware, the split-message scheme recovered an 8-bit message across four robots in 12 s.The simulation result includes the adversarial multi-agent Football setting.Source: §1 · p. 3
2 Related Work
The paper distinguishes MTM from prior approaches by combining keyed, remote observation with arbitrary multi-symbol messages carried by physical motion. Its closest foundation is remotely detectable policy watermarking.
Watermarking
- Prior watermarking spans media signals, cyber-physical control, and neural-network or policy ownership, but these approaches do not provide keyed, remote, multi-symbol communication through motion.The passage cites spread-spectrum watermarking, generative-model work [9] [10], dynamic watermarking [12], and neural-network or policy watermarking [15] [16] [19].Source: §2 · p. 3
Remotely detectable robot-policy watermarking
Steganography
- Generative-model message-hiding methods embed messages in latent noise or token sampling, whereas MTM uses stochastic-policy exploration noise and makes no claim that watermark presence is statistically undetectable.MTM hides message content from observers without the key, not the presence of a watermark.Source: §2 · p. 3
Legible motion
- Legible-motion methods shape trajectories to reveal a known task goal to any observer, while MTM encodes arbitrary messages as subtle, keyed perturbations decoupled from the task.Source: §2 · p. 3
3 Problem Setting
The problem is to transmit a keyed message through a robot’s motion while preserving task performance and limiting recovery by observers without the key.
3 Problem Setting
- The robot follows a fixed, pre-trained stochastic policy, and the auditor observes only its resulting motion through remote sensing, not the commanded actions.Source: §3 · p. 4
- The message is a sequence of L symbols from an alphabet of size M, encoded by perturbing policy actions at inference time without retraining, architectural changes, or extra hardware.Source: §3 · p. 4
- The goal is to recover the message with probability at least 1−ϵ in the shortest time T while preserving task performance and keeping unkeyed recovery at or near chance.Source: §3 · p. 4
4 Preliminaries
The preliminaries describe the remote-observation challenges for motion watermarking and position CoNoCo as a single-bit primitive that MTM extends through a generate–score interface.
4 Preliminaries
- The Physical Observation Gap arises because a remote auditor sees physical consequences rather than commanded actions, with synchronization uncertainty, robot dynamics, and behavior or sensor noise complicating detection.Source: §4 · p. 4
- The remote sensor supplies sampled observations derived from the robot’s state, such as video-based velocity estimates, with measurement noise.Source: §4 · p. 4
- CoNoCo [3] uses keyed colored Gaussian noise in a secret frequency band and spectral coherency to address synchronization, dynamics, and interference, but returns only a binary decision.Source: §4 · p. 4
- MTM treats the watermarking primitive as a generate–score interface: it assigns different seeds to symbols and decodes each window using the highest-scoring seed.The interface allows another remotely detectable watermarking method to replace CoNoCo; the experiments instantiate it with keyed colored Gaussian noise and spectral coherency.Source: §4 · p. 4
5 Method
MTM turns keyed policy-action noise into messages that can be decoded from remote motion observations. Its design balances channel strategy, alphabet size, and symbol duration to meet accuracy targets quickly.
5 Method
- MTM embeds key-dependent signals in policy actions and decodes symbols from remote observations by checking which keyed signal is most present.It modifies pre-existing policy noise, and the experiments use CoNoCo as the watermarking primitive.Source: §5 · pp. 4–5
5.1 Channels
- Channels are observable actuated degrees of freedom tracked remotely; MTM can send the full sequence on one channel, duplicate it across channels, or split it among channels.Duplicated messages pool detection scores across channels; split messages carry independent parts.Source: §5.1 · p. 5
5.2 Encoding and Decoding
- Larger alphabets convey log2 M bits per symbol, allowing longer windows for a fixed payload and better noise averaging, but increase candidate confusion.Each symbol is associated with a distinct keyed random seed.Source: §5.2 · p. 5
- For each time window, the auditor scores every keyed candidate against the observed motion and selects the highest-scoring symbol.Repeating this process over the symbol windows recovers the message.Source: §5.2 · p. 5
5.3 Design Space
- The design procedure selects the shortest transmission time that meets a target message accuracy, using empirical per-symbol accuracy and an independent-errors approximation.It searches the measured accuracy table and chooses the scheme with the smallest total time.Source: §5.3 · pp. 5–6
6 Results
Across four simulated tasks and RoboMaster, MTM is evaluated from video or motion-capture traces while alphabet size, channel allocation, and message duration vary. Results include reliable hardware recovery and task-dependent simulation outcomes.
Discovery: General Design Choices
- At M=8, Discovery reaches 95% across all T and 100% at T=108; combining x/y under same-message consistently beats either single channel.Source: Figure 3 · p. 6, §6 · p. 6
Lunar Lander: Challenging Dynamics
- At M=8, Lunar Lander same-message reaches 100% at T=288; the stronger y-channel reaches 90% at smaller T and motivates unequal split allocation.Source: Figure 4 · p. 7, §6 · p. 7
Reacher: Articulated Motion
- At T=240, inner-arm single-channel reaches 100%; mechanically coupled arms cancel watermark signals, leaving same-message with little gain and split-message below predicted accuracy.Source: Figure 5 · p. 7, §6 · p. 7
Football: Multi-Agent and Adversarial
- At M=64 and T=516, Football same-message reaches 100%; equal split allocation across three similar agents outperforms same-message at smaller M.Source: Figure 6 · p. 8, §6 · p. 8
RoboMaster: Real-World Deployment
- At T=600 policy calls, all four robots decode correctly in every rollout; this carries 8 bits in 12 s (0.67 bits/s aggregate, 0.167 per robot).The operating point is 35% of the trajectory length.Source: Figure 7 · p. 8, §6 · p. 8
Results Summary
- Larger M often improves accuracy for fixed payload and time; same-message suits general use, while split-message shortens transmission with asymmetric channel accuracies.Source: §6 · pp. 8–9
7 Conclusion
MTM encodes keyed messages in a pre-trained stochastic policy’s action-noise channel for decoding from remote motion observations, without policy retraining, architectural changes, or extra hardware. Across simulated domains and a real-robot deployment, it carries useful messages at little cost to behavior, while exposing trade-offs in transmission speed, robustness, and channel reliability.
7 Conclusion
- MTM maps symbols to keyed noise signals, injects them through a pre-trained stochastic policy’s action-noise channel, and decodes them from remote motion observations.The method requires no policy retraining, architectural modification, or additional communication hardware.Source: §7 · p. 9
- 1.00 →0.90 scoring rate in Football with watermarking, showing that MTM’s behavioral cost is small but not zero.The evaluation spans four simulated domains and a real-robot RoboMaster deployment.Source: §7 · p. 9
- Larger alphabets reduce transmission time, redundant same-message encoding improves robustness, and channels can differ substantially in reliability.Source: §7 · p. 9
- Motion is observable whenever a robot acts, so a keyed motion channel can complement existing systems by letting auditors recover intent, identity, or protocol information from physical behavior.Source: §7 · p. 9
8 Limitations
MTM is limited to discrete messages that remain piecewise constant during each symbol window, and its payloads are short. Its security, sensing, and performance claims also have specific boundaries.
8 Limitations
- MTM cannot represent continuously evolving messages such as precise scalar quantities because it assumes discrete messages that remain piecewise constant over each symbol window.Source: §8 · p. 9
- MTM works for stochastic policies, while policies with low randomness cannot use it; reliability over substantially longer payloads is untested because per-symbol errors compound.Source: §8 · p. 9
- Hardware decoding has been tested with motion capture, not real uncalibrated RGB video or occlusion; energy and actuator wear were not measured, and performance degradation has no precise bound.Tracking error is equivalent between watermarked and clean rollouts, but preserving marginal per-timestep action distributions does not bound closed-loop trajectories.Source: §8 · p. 9
- The security result is keyed closed-set decoding, not covertness, authentication, integrity, or replay resistance, and robustness to steganalysis or known-plaintext attacks is unclaimed.Source: §8 · p. 9
A.1 Notation
Table 1 is presented as a list of key mathematical symbols and their descriptions.
A.1 Notation
- Table 1 lists key mathematical symbols alongside descriptions.Source: Table 1 · p. 12
A.2 Policy and Controller Details
The appendix describes the controllers, perturbations, rollout conditions, and video settings used across four simulated environments. Each rollout uses a distinct codebook and paired environment seed, making the reported accuracies draws from their joint distribution.
A.2 Policy and Controller Details
- Each rollout uses its own codebook and paired environment seed, making the 50 rollouts per (M, T) cell i.i.d. draws from the joint codebook–environment-seed distribution and removing single-codebook bias.This is a variance-reduction measure, not part of the protocol.Source: §A.2 · p. 12
- Discovery uses a scripted navigation controller at 10 Hz with additive CGN perturbations (σ=0.03), encoding 3-bit goal indices across eight sequential goals per rollout.Video is recorded at 704×704 px.Source: §A.2 · p. 12
- Lunar Lander uses a PD hover controller at 50 Hz with σ=0.5, eight goals per rollout, and a 150-step off-camera warmup before watermarking and video recording.Video is recorded at 600×400 px.Source: §A.2 · p. 12
- Reacher uses SAC trained for 1.9×10^5 steps, controlled at 50 Hz, and visits eight targets on a ring of radius r=0.14, each encoding a 3-bit sector index.The perturbation is σ=1.0; video is recorded at 480×480 px.Source: §A.2 · p. 12
- Football uses three agents in a 3v3 setting at 10 Hz, with all agents carrying the same CGN pattern and 64 strategies evaluated over 3,200 rollouts per (M, T) cell.The strategies vary four behavioral parameters; video is recorded at 1200×800 px.Source: §A.2 · p. 13
A.3 Detection Pipeline Details
The appendix details channel allocation and evaluates MTM on simulated tasks and physical robots, alongside analyses of task performance, decoding conditions, error correction, and adversarial robustness.
A.5 Keys and Synchronisation
- Experiments vary the codebook across rollouts to average over codebooks, but deployment uses a fixed codebook derived from a long-lived shared key; message length and boundaries are agreed in advance.The protocol does not prevent replay or substitution by another key-holder; sender or time binding requires a separate authentication layer.Source: §A.4 · p. 13, §A.5 · pp. 13–14
A.6 Approximate Multi-Channel Symbol Allocation
- Capacity-based allocation assigns more symbols to reliable channels, but assumes 100% target accuracy, equal total symbol counts per channel, and asymptotically long messages.Calibration and evaluation share seeds, and the authors note that the capacity-based allocation is an approximation.Source: §A.6 · p. 14
A.8 Lunar Lander: Numerical Results
- At M=2, Lunar Lander accuracy dips slightly at T=576 versus T=480; Reacher’s inner arm is stronger, while mechanical coupling undermines the independent-channel allocation heuristic.The Lunar Lander’s extended hover phase interferes with the final symbol; the Reacher result identifies linked-arm coupling as the heuristic’s failure mode.Source: §A.8 · p. 16, §A.9 · p. 17
A.11 RoboMaster: Numerical Results
- 100% message recovery was achieved in simulation across five environments; on hardware, four robots recovered an 8-bit message in 12 s at 0.67 bits/s.The hardware result had a 95% binomial confidence interval of [83.2, 100]% for joint recovery.Source: §A.11 · p. 19
A.12 Null Conditions
- Near-chance recovery in null conditions supports key-dependent decoding and no spurious symbols from unwatermarked motion, but does not establish secrecy against steganalysis or learned classifiers.The authors did not evaluate those adversaries or repeated-message observation under a fixed codebook.Source: §A.12 · p. 19
A.13 Error-Correcting Codes Analysis
- Longer uncoded transmission often matches or beats Reed–Solomon coding where accuracy is still rising; coding tends to help after the uncoded curve plateaus below 1.The comparison concerns spending the same total time budget on longer uncoded transmission versus parity goals.Source: §A.13 · p. 19
A.14 Task Performance Preservation
- In Football, watermarking changes scoring rate from 1.00 to 0.90 and mean ball-to-goal distance from 0.818 to 0.917; equal-amplitude WGN costs slightly more.Watermarking matches the clean controller in Discovery and has no detectable effect in Lunar Lander or Reacher; energy and actuator wear were not measured.Source: §A.14 · p. 20
A.15 Adversarial Robustness
- An order-2 Butterworth notch reduces message accuracy from 100% to 22% with 36% command-space distortion and 4% greater mean agent–goal distance; order 6 is needed to reach chance, at +12.2%.The authors leave adaptive jamming unevaluated; a history-conditioned jammer may partially predict the coloured watermark without recovering its key.Source: §A.15 · p. 21