TRACE: Temporal Gradient Inversion Attack for Private Trajectory Reconstruction in Embodied RL

Paper Overview

• Field: Machine Learning
• Authors: Sudip Bhujel, Shanghao Shi, Ruiquan Huang, Ning Zhang, Yang Xiao
• Published: 2026-09-24
• arXiv: 2609.30258

Summary

Distributed learning in embodied reinforcement-learning agents offers a degree of privacy by retaining raw sensor data on-device and transmitting only policy gradients to the server. Yet temporal structure can amplify this leakage beyond single-frame attacks.

The authors introduce TRACE (Temporal Reconstruction Attack on Consecutive Encodings), an amortized temporal gradient-inversion attack that autoregressively reconstructs the sequence of private observation-action trajectories from per-step policy-learning gradients.

The attack exploits two structural signals ignored by prior single-frame methods:

1. Cross-time correlation between successive embodied gradients, formalized via a conditional mutual-information bound. 2. Closed-form action recovery from policy-head gradient structure — the authors prove this recovery is exact when standard entropy regularization is sufficiently small.

Key Results

• On held-out embodied scenarios, TRACE achieves 18.8 dB PSNR with near-perfect action recovery.
• Reconstruction takes only 3–4.5 ms per frame.
• It outperforms learning-based baselines on all reconstruction metrics while being orders of magnitude faster than optimization-based attacks.
• TRACE generalizes across recurrent, residual, and compact Transformer victim architectures, multimodal inputs, and larger discrete action spaces.
• Defense experiments indicate that protecting temporal gradient flows may require sequence-aware privacy mechanisms.

Original Abstract (excerpt)

> Distributed learning in embodied reinforcement-learning agents offers a degree of privacy by retaining raw sensor data on-device and transmitting only policy gradients to the server. Yet temporal structure can amplify this leakage beyond single-frame attacks. We introduce Temporal Reconstruction Attack on Consecutive Encodings (TRACE), an amortized temporal gradient-inversion attack that autoregressively reconstructs the sequence of private observation-action trajectories from per-step policy-learning gradients. The attack exploits two structural signals ignored by prior single-frame methods: (i) cross-time correlation between successive embodied gradients, which we formalize via a conditional mutual-information bound, and (ii) closed-form action recovery from policy-head gradient structur...

Link: <https://arxiv.org/abs/2609.30258>