Research map / Federated learning and privacy / Privacy attacks and secure learning

Temporal Gradient Inversion for Private Trajectory Reconstruction in Embodied Reinforcement Learning

NeurIPS 2026 · Federated learning and privacy › Privacy attacks and secure learning · approach: Gradient inversion attacks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes TRACE, an amortized autoregressive transformer that reconstructs private RGB observations and discrete actions from ordered per-step policy-gradient streams of embodied RL agents (PPO/A2C), with closed-form action recovery and a temporal mutual-information analysis.

Problem

Gradient inversion of private embodied RL trajectories: an honest-but-curious server observing per-step actor-critic gradients from a client can recover time-ordered camera observations and actions, which prior single-frame or per-gradient optimization attacks ignore.

Approach

An autoregressive causal transformer conditioned on encoded per-step gradients and previously decoded frames, trained with teacher forcing, scheduled sampling and a rollout loss, plus a closed-form policy-head column-sum rule for exact discrete-action recovery when entropy regularization is small.

Key results

• TRACE reaches 18.8 dB PSNR and 100% action accuracy on PPO victims with 4.5 ms per frame, versus 16.8 dB for LtI and 5.5 dB for DLG.
• Few-shot adaptation with 50% target trajectories raises PPO PSNR to 23.8 dB and lowers MSE to 0.005.
• DP-SGD reduces action accuracy to near-random (~20%), while 2-bit quantization drops PPO action accuracy to 19.4%; pruning to 10% keeps PSNR near 18.8 dB.

Surprising findings

• Pruning retaining only 10% of gradient entries leaves PPO reconstruction nearly intact, so lightweight sparsity defenses are ineffective.
• TRACE at T=1 underperforms LtI's single-frame result, so its gain is attributed to temporal conditioning rather than a stronger per-frame extractor.

Limitations

• Assumes per-step gradients at the broadcast checkpoint; multi-step client updates may reduce temporal structure.
• Closed-form action recovery is exact only under small entropy regularization and non-degenerate policies; the temporal-gain bound is exact only under Markov victim and one-step estimator assumptions.
• Evaluated only on a point-goal navigation task in AI2-THOR with a five-action discrete space and small 84x84 RGB inputs.

Experimental setup

Datasets: AI2-THOR point-goal navigation trajectories (auxiliary and held-out scenes)

Benchmarks: AI2-THOR point-goal navigation

Metrics: MSE PSNR SSIM LPIPS action accuracy inference time per frame

Baselines: DLG Inverting Gradients (IG) Learning to Invert (LtI)

Builds on: Deep Leakage from Gradients (DLG) Inverting Gradients Learning to Invert PPO A2C scheduled sampling

Closest papers by meaning

• EnvTrap: Revealing the Environment-Only Attack Surface in Embodied AI via Consequence-Blind Action Execution (NeurIPS 2026 · similarity 0.85)
• Memo: Training Memory-Efficient Embodied Agents with Reinforcement Learning (NeurIPS 2025 · similarity 0.84)
• On the Sample Complexity of Differentially Private Policy Optimization (NeurIPS 2025 · similarity 0.84)
• Imitation from Observations with Trajectory-Level Generative Embeddings (NeurIPS 2026 · similarity 0.83)
• Contractive Dynamical Imitation Policies for Efficient Out-of-Sample Recovery (ICLR 2025 · similarity 0.83)
• High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.83)