Venue: ICLR 2026 Authors: Michael Amir · Manon Flageat · Amanda Prorok (Prorok Lab, University of Cambridge) arXiv: 2512.15379 Category: Robustness / security for VLA Trend tag: IP protection · spectral watermarking · remote detection

flowchart LR
  POL[Trained robot policy<br/>inherent action stochasticity] --> CN[CoNoCo:<br/>embed colored-noise spectral signal]
  CN --> ACT[Watermarked actions<br/>marginal action dist. preserved]
  ACT --> ROBOT[Robot executes motion]
  ROBOT -->|unknown system dynamics<br/>noisy · asynchronous| OBS[Remote glimpse sequence]
  OBS --> MOCAP[Motion capture]
  OBS --> VID[Side-way / top-down video]
  MOCAP --> SC[Spectral Coherency detector]
  VID --> SC
  SC -->|invariance cancels filtering| VERDICT[Provenance verified remotely]

A trained robot policy is a new form of intellectual property, raising the need to verify ownership and detect unauthorized or unsafe misuse. Watermarking is established in other domains, but physical policies pose a unique challenge: remote detection. Existing methods assume access to the robot's internal state, whereas auditors are often limited to external observations such as video footage. The authors call this the "Physical Observation Gap" — the watermark must be recovered from signals that are noisy, asynchronous, and filtered by unknown system dynamics.

The paper formalizes the setting via a glimpse sequence abstraction and introduces Colored Noise Coherency (CoNoCo), the first watermarking strategy designed for remote detection:

1. Embedding — CoNoCo embeds a spectral signal into the robot's motions by leveraging the policy's inherent stochasticity (colored action noise), rather than altering the deterministic behavior.
2. Non-degradation guarantee — the authors prove CoNoCo preserves the marginal action distribution, so watermarking does not degrade task performance.
3. Detection — uses Spectral Coherency, a normalized frequency-domain metric (analogous to a correlation coefficient at specific frequencies) whose invariance property cancels the filtering effect of unknown system dynamics, enabling detection from purely remote observations.

Experiments demonstrate strong, robust detection across multiple remote modalities — motion capture and side-way / top-down video footage — in both simulated and real-world robot experiments. This is presented as the first method for validating the provenance of physical policies non-invasively, from external observation alone.

CoNoCo opens robot-policy IP protection to the realistic auditing regime where only external video or tracking is available, sidestepping the unrealistic assumption of internal-state access. The frequency-domain invariance to unknown system dynamics is the key enabler, making provenance verification practical for deployed physical systems.

• arXiv: https://arxiv.org/abs/2512.15379

• RobustVLA — adjacent robustness / security theme
• Survey: VLA & Manipulation

← Back to ICLR-2026