Remotely Detectable Robot Policy Watermarking
Authors: Michael Amir
Manon Flageat
Amanda Prorok
Venue: ICLR 2026 Poster (2026)
Keywords: watermarking
robotics
stochastic policies
Primary area: applications to robotics, autonomy, planning

Abstract: The success of machine learning for real-world robotic systems has created a new form of intellectual property: the trained policy. This raises a critical need for novel methods that verify ownership and detect unauthorized, possibly unsafe misuse. While watermarking is established in other domains, physical policies present a unique challenge: remote detection. Existing methods assume access to the robot’s internal state, but auditors are often limited to external observations (e.g., video footage). This “Physical Observation Gap” means the watermark must be detected from signals that are noisy, asynchronous, and filtered by unknown system dynamics. We formalize this challenge using the concept of a glimpse sequence, and introduce Colored Noise Coherency (CoNoCo), the first watermarking strategy designed for remote detection. CoNoCo embeds a spectral signal into the robot’s motions by leveraging the policy’s inherent stochasticity. To show it does not degrade performance, we prove CoNoCo preserves the marginal action distribution. Our experiments demonstrate strong, robust detection across various remote modalities—including motion capture and side-way/top-down video footage—in both simulated and real-world robot experiments. This work provides a necessary step toward protecting intellectual property in robotics, offering the first method for validating the provenance of physical policies non invasively, using purely remote observations.

Published as a conference paper ICLR 2026
REMOTELY DETECTABLE ROBOT POLICY WATERMARKING
Michael Amir, Manon Flageat" & Amanda Prorok University of Cambridge (ma2151, mf mf873, asp45 8 ac.uk
ABSTRACT
The success of machine learning for real-world robotic systems has created new form of intellectual property: the trained policy. This raises a critical need for novel methods that verify ownership and detect unauthorized, possibly unsafe misuse. While watermarking is established in other domains, physical policies present a unique challenge: remote detection. Existing methods assume access to the robot's internal state, but auditors often limited to external observations (e.g.. video footage). This "Physical Observation Gap" means the watermark must be detected from signals that are noisy, asynchronous, and filtered by unknown system dynamics. We formalize this challenge using the concept of glimpse se- quence, and introduce Colored Noise Coherency (CoNoCo). the first watermarking strategy designed for remote detection. CoNoCo embeds spectral signal into the robot's 's motions by leveraging the policy's ' inherent stochasticity. To show does not degrade performance, we prove CoNoCo preserves the marginal action distribution. Our experiments demonstrate strong, robust detection across various remote modalities-including motion capture and hide-way/top-down video footage-in in both simulated and real-world robot experiments. This work provides a necessary step toward protecting intellectual property in robotics, offering the first method for validating the provenance of physical policies non-invasively, using purely remote observations.
INTRODUCTION
The rise of machine learning in robotics has yielded nigh-performance policies capable of sophisticated locomotion, manipulation, and navigation (Lee et al. 20200] Smith et al. [023 Hoeller et al. 2024).. These policies, often deep neural networks resulting from significant investment, represent critical new form of intellectual property (IP). As commercial deployment accelerates, the risk of unauthorized misuse and theft escalates, creating an urgent need for reliable methods to verify ownership and provenance.
Digital watermarking is the standard mechanism for IP protection in domains like multimedia (Cox et al. 1997) large language models (Kirchenbauer al. 2023 Dathathri et al. 2024).. However, existing methods for watermarking policies (Behzadan & Hsu [2099] Chen et al.) (021)) suffer from a critical limitation: they assume white-box access the system, requiring direct inspection of internal states, action logs, or specific trigger environments. In realistic scenarios (Figure D such access is often impossible or untrustworthy.
The ability to verify policy provenance using only remote observations (e.g.. CCTV footage) is essential not only for IP protection but also for high-impace AI safety applications. For instance, remote detection enables Scalable Safety Compliance. allowing regulators non-invasively verify whether safety-critical systems (e.g., autonomous vehicles) are authorized for deployment by checking them against a database of certified policy signatures. also facilitates Trustworthy Forensics and Accountability. Following an incident (e.g..
"Equal contribution in alphabetical order.
Project website and code:

---

Published as a conference paper ICLR 2026
Step 1: Watermark definition
Step 2: Watermark injection
Step Watermark detection
Remote Sensing
Policy auditor
Watermarked policy
defines
observation
action
Palicy owner
Detection
glimpses
Detection score
function
Policy user
Robot
Figure 1: Overview of the pipeline for robot policy watermarking, In Step the policy owner trains a policy, adds watermark to it and produces detection function to identify it. In Step 2, the watermarked policy is used by policy user who deploys it on their own robot. In Step 3, policy auditor aims to identify the policy used on the robot. To do so, they only access glimpses of the policy behaviour through remote sensing, such as a camera feed; these glimpses are passed through the detection function to identify the policy.
an autonomous vehiele crash or industrial accident), determining the provenance of the deployed control software is critical for liability. Relying solely on onboard logs is insufficient, as they may be unavailable due damage or deliberately tampered with by adversarial actors seeking evade responsibility or fraudulently claim damages. Remote watermark detection provides an independent mechanism for auditors to verify the active policy using external, ramper-resistant data sources like traffic camera footage.
These scenarios introduce fundamental challenge we term the Physical Observation Gap. The auditor does not observe the policy's actions (say, torque commands), but rather their consequences (say, movement captured by camera). The watermark signal must cross this gap, surviving severe distortions that destroy traditional watermarking signatures. This entails three primary challenges: (C1) Synchronization Uncertainty between the policy's clock and the remote sensor; (C2) System Dynamics filtering the actions through the robot's complex, unknown physics (c.g., inertia, friction); and (C3) Interference and Noise from the robot's s primary behavior and the environment.
In this work, we introduce Colored Noise Coherency (CoNoCo), the first watermarking strategy for robot policy designed to enable remote watermark detection. CoNoCo operates in the frequency domain. It embeds the watermark by exploiting the inherent stochasticity of standard continuous control policies. The watermark is then detected using Spectral Coherency, normalized frequency-domain metric conceptually analogous a correlation coefficient for specific frequencies. It possesses notable invariance property that cancels out the filtering effects of unknown system dynamics (Theorem (.2)). This allows us to, e.g., inject the watermark on the level of torque commands executed by the robot, but detect it even when we only observe noisy, video footage-derived velocity estimates. By combining this invariance with explicit synchronization techniques, CoNoCo achieves robust detection despite the challenges of the Physical Observation Gap.
Our contributions are summarized as follows. (i) We formalize the problem of remotely detectable policy watermarking using the concept of glimpse sequences and characterize the fundamental challenges posed by the Physical Observation Gap (C1-C3). (ii) We introduce CoNoCo, a novel requency-domain strategy based colored noise injection and spectral coherency detection. To our knowledge, it is the first method capable of verifying policy provenance using only remote measurements. (iii) Finally, we demonstrate CoNoCo's 's effectiveness in simulated and real-world robot tasks with challenging detection modalities like motion capture, and top-down, and sideway video footage. We compare it to adapted variants of existing watermarks, and show its robustness different types of noise and interference (including deliberate adversarial noise).
2

---

Published as a conference paper ICLR 2026
2 RELATED WORK
Digital Watermarking and Signal Processing, Watermarking has historically been used for IP protection in multimedia (Berghel & O' G'Gomman [996] Swanson et al,, (198), with methods such as Spread Spectrum (Cox et al. 1997) embedding robust, imperceptible signals across wide frequency bands. More recently, watermarking has been applied to generative models (Wen et al. [023 Kirchenbauer et al. [0023] Dathathri jet al. 2024). These methods assume access to well-behaved signals and struggle with the dynamics of remote physical systems; in this work, we extend these frequency-domain principles to such challenging settings.
Watermarking in Phhberllysscal Systems (CPS). In CPS security, "dynamic watermarking"" defends robots against sensor attacks by superimposing signals onto control inputs (Satchidanandan & Kumar 2016 Ko jet al. 2016). While related, these methods target real-time security (integrity) rather than IP (provenance) and crucially assume auditor access to internal control signals.
Watermarking Neural Networks (NN), Methods exist to verify ownership of NN models by embedding signatures into weights (Darvish Rouhani et al. 2019) using rare "trigger" inputs (backdooring) (Adi et al. 2018 Szyller et al. 2021). These require white-box access or the ability to actively query the model.
Watermarking Policies and Agents. Prior work on policy watermarking typically modifies behavior in specific situations. [ehhadan & Hsu (2019) requires execution in a secret "trigger environment." " Chen et al. (202T) enforces secret actions in specific "safe states." Methods for agentic systems (Huang et al. (2055) watermark high-level behavior. Unlike CoNoCo, all of these approaches require access to the internal state of the policy, making them unsuitable for remote detection.
3 PROBLEM STATEMENT
We address the challenge of watermarking stochastic robotic control policy Ty that the watermark be detected using only remote measurements. The policy maps observations Oμ E O to actions ag E AA at discrete time steps
0, I.... We assume a standard structure common in continuous control Reinforcement Learning (RL), where the policy outputs the parameters of Gaussian distributior ag (o(0)) + Eg (ox) Cg.- Here, μ4 the mean action (the primary behavior). and Σg(or) determines how much the action deviates
from the mean, which we call the exploration scale. éa ~ (O, I) is White Gaussian Noise uncorrelated noise used for exploration. robot, R, executes this policy.
The objective is to create a watermarked policy 2o using secret key K. An auditor, possessing K., must detect this signature using only remotely collected, passive data (c.g., video footage), without access to the robot's internal state. This is difficult due to the challenges (CI-C3) and requirements (W1-W2) below.
Firstly, we must overcome the "Physical Observation Gap":: the separation between the digital policy execution and the remote physical observations. This gap introduces three primary challenges:
CL. Synchronization Uncertainty. The policy executes at an internal rate fax which often unknown (within bounds [fx, uu)) and may vary (jitter). Remote sensors (rate fa) sample independently. This causes frequency misalignment. Furthermore, the recording might start at an arbitrary time after the policy execution begins, introducing unknown time offset.
C2. System Dynamics. The auditor does not see the policy commands (e.g., motor torques); they see the physical response (e.g., movement), which is transformed by the robot's unknown and time-varying physical dynamics Sayn- The physics filter and distort the original signal.
'Often, the action is bounded by saturation function (c.g., as tanh(... )). For simplicity, omit this in our theoretical analysis; however, our experiments show that detection remains effective even when such function is applied.
3

---

Published as a conference paper ICLR 2026
C3. Interference and Noise. The policy behaviour μn is typically much stronger than the watermark signal, acting as significant interference. External disturbances and sensor noise further corrupt the observation.
We model the Physical Observation Gap through Glimpse Sequence Formalism. The policy runs at un- known times {Tk,. The executed action Gexec (t) drives the robot's state evolution s(t) Sayn (s(), Gexoc Definition 3.1 (Glimpse Sequence). A remote sensor samples the state at times {t,} (rate fgh. producing measurements G Smap(st (s(t,)) + nre where qi is measurement noise. The sequence G (G N-1 is the glimpse sequence, the sole data available for detection. 9map is a function that maps the state of the system time & to a remote observation, such as a velocity estimate from video data. In complex (MIMO) systems, G is multi-dimensional; we denote the d-th dimension as Gd-
Secondly, to be useful, the watermarked policy 7i must satisfy two requirements:
W1. Marginal Distribution Preservation. To ensure the watermarked policy behaves like the original, we require the probability distribution of actions to remain unchanged: Pr, (a o) = p*, (alo) for all o, a.
W2. Robust Detectability. The detector Dx(G) must reliably distinguish Ti from my despite C1-C3.
4 THE COLORED NOISE COHERENCY STRATEGY (CONoCo)
The distortions caused by the Physical Observation Gap (CI-C3) make detection methods based on precise timing (time-domain) fragile. We introduce Colored Noise Coherency (CoNoCo), a strategy that analyzes the signal's frequency content (frquuency-domaing which more robust to these distortions, CoNoCo operates on two principles (i) It embeds the watermark by replacing the WGN exploration noise with normalized Colored Gaussian Noise (CGN). CGN is type of "shaped" noise that concentrates energy in target frequency band. We show in Section 5 that this approach improve detection while satisfying W1. (ii) It detects this signature using Spectral Coherency, a technique robust to unknown dynamics, combined with synchronization methods address remote sensing challenges.
Watermark Generation and Injection. We generate the watermark by creating a CGN sequence, We, to replace the original WGN eg. The watermark is defined by secret key K. = (S, B). where S is secret seed and B- = [min, maax] is a frequency band (e.g., in Hz). The process is described in Algorithm
To generate WK. we filter pseudorandom WGN sequence X (derived from S) using a digital Band-Pass filter H. The goal is for the physical actions to vibrate within B. Since the physical frequency depends on the uncertain policy rate fa (C1), the digital filter spans [fmin/ fx, aa, fmaz/ f=.j)]. This guarantees the resulting physical signal covers B, regardless of fx. X is then filtered and normalized to produce W₁.
The watermarked policy 7o utilizes this CGN:
(0(())) E. WR. The advantage of targetting specific band B is that it can be chosen outside the anticipated frequencies spectrum of (Og())), reducing policy interference (C3). Note that the time-varying exploration scale Σg changes the amplitude of the watermark; we analyze this effect in Section If the policy action is minei-dimensional, we generate independent CGN sequences for each dimension to improve detection.
Watermark Detection Strategy. The detection strategy (Algorithm 1 aims to address the Physical Ob- servation Gap. We first address the challenge of an unknown policy frequency (C1). The unknown policy frequency fx must be found. The detector searches over grid of candidate frequencies Fsearch S [f ub). For each candidate s, the detector regenerates the watermark W and resamples (time-stretches) it from the hypothesized rate to the known glimpse rate fa. yielding hypothesis W.. This aligns the time scales. We next address (C2). Detecting the watermark after it passes through unknown system dynamics is challenging. We use Spectral Coherency, frequency-domat metric analogous correlation in statistics.
4

---

Published as conference paper ICLR 2026
Definition 4.1 (Complex Coherency).. The Complex Coherency Cxy between two processes X and Sxy(f)
frequency f is defined as: Cxv( /Sxx(f)yyyl) Here, Sxx ( and Srv(J) (J) are the Power Spectral Densities (PSDs), representing the energy (variance) o and Y frequency f. (xy(f) is the Cross-Spectral Density (CSD), representing the covariance between X and Y at frequency f.
Coherency is normalized version of the CSD. Its magnitude [C)y E [0, 1] acts like correlation coefficient frequency f. indicating the strength of the linear relationship between X and Y. Crucially, if Y is the output of a Linear Time-Invarinn
(LTT) system H with input X. then (Cxy(f) = 1, regardless of the specifics H (Theorem 5.2) This property makes CoNoCo robust to system dynamics. For example, if the glimpses are related to the robot's s actions by an ODE with constant coefficients (e.g., robot executes torque commands but we observe velocity glimpses), this transformation LTI, and does not impact coherency.
For given hypothesis 8, calculate the coherency between W and G. Let Cwia. (f: s) be the coherency between the d-th dimension of W and the glimpse Ga. The final detection score is the maximum average magnitude within the secret band B, calculated using Welch's 's method (Karl 2012). which breaks the signal into segments, and optimized over hypotheses: D(G) max
mean meanyes|Cwija. (e
Algorithm I Watermark generation and detection procedures.
Watermark Generation
Watermark Detection
Require: Seed S, Length N, Dimensions D. Band B
Require: Glimpses G. Glimpse Freq fo. Key 1C
mmn Smaz), Freq Bounds [fr,bb, fr.ub]
{S, Search Range Foarch
W Zeros( N,
NumDimenniions(C); Best.Score
Brow + fmin/ fu.bbi Bhigh f- -fmaz/ fr.b
Wease +- DeggennateWacmmarkSSSeunnnee
3: Hs + DDesggnButerroorhPPP((MC (Bloo Brigh)
3: for & Faenchh do
> Frequency Alignment
4: for d = 1 to D do
4: W + ResamplePPoly (a sa/s)
Sa +- ( d)
5: Scoresum +-
X Generate (Sa, N)
for 1 do
W Wmw + ApplyLTIFilte((Hs, X)
7:
Wí + |G]
8:
W|: d] + Wan/ Std Wmm)
D Normalize
8:
f, F. + Coherency GG d), Wa, fa)
9: return W
Scorea + Mean Abs Calff f E B)) 10: Scoresum Score + Scorea
9:
11:
if Scoreeemm D > Seore then
12: Best + Scoresum D
13:
return Best.Soore
Returning to (CI), we must also consider the possibility of time offset, where the glimpse sequence starts being recorded some time after the policy has already begun being executed, hence the glimpse data does not collect some initial fraction of the Wi sequence. While Algorithm [ described here, assumes the glimpse sequence begins at minimal time offsets from the start of the robot's policy execution, we can robustly address time offsets using the Generalized Cross-Correlation Phase Transform (GCC-PHAT)) This is shown Appendix G.T
5 ANALYSIS OF WATERMARK PROPERTIES
We now study the properties of CoNoCo. Theorem proofs are provided in the Appendix.
(W1) Marginal Distribution Preservation and Utility. We show that the watermark injection process preserves the statistical distribution of the exploration noise (Theorem 5.1 proving requirement (WI).
5

---

Published as a conference paper ICLR 2026
Theorem 5.1. Let Wk be generated by filtering WGN sequence Xx 10,, through a stable LTI filter H. followed by normalization to unit variance. Then the marginal distribution of Wa is also NO, T).
Theorem 5.1 establishes that Pro (alo) = Pa, (a o); the statistics of the actions at any single time step are identical for the watermarked and original policies. However, using CGN instead of WGN introduces temporal autocorrelation: the noise at one time step is related to the noise at previous steps, rather than being fully independent. We empirically show that this does not affect system performance if the band B is chosen appropriately. The reason CGN is often benign is noted in (Lillicrap et al. 2015): temporally correlated noise can lead to smoother exploration, often improving performance in continuous control.
(W2) Robust Detectability. Detectability relies on the properties of Spectral Coherency. We first start with idealized assumptions, assuming constant dynamics (LTI) and constant exploration scale (2;, 2.). The system mapping the watermark W to the glimpse G, is LTI (Linear Time-Invariant) The core reason we use coherency for detection is that coherency can "see through" the dynamics; e.g., even if the robot uses torque actions but we observe velocity glimpses, the detection score is not affected by this transformation. This is expressed in the following, well-known theorem (Karl 2012):
Theorem 5.2 (Invariance of Coherency Magnitude under LTI Filtering). Let X and be stationary processes related by an LTI system Hays- In the absence of noise, [Cxy(J) = 1, regardless of Hays (provided Hays (f) + 0, (xx > 0).
In practice, the glimpse G is corrupted by interference from la and sensor noise T/4 (C3). We quantify the effect of this interference using the Signal-to- Signal-to-Intererree Interferencee seceeffrrence-luu-Noiiss Ratio (SINR).
Interference- pneefference-plus--e plus-Noise Ratio (SINR)). The SINR at frequency f is the ratio of Definition 5.1 (Signal-to-mmeeferennee
the desired signal power to the power of the undesired components: SINR(f) = Px(f)- Here, Ps(f) is the power (P (PSD) of the watermark signal in the glimpse, and ()) is the power of the interference from the policy Pk. sensor noise, and other sources.
Ps(f)
Theorem 5.3 (SINR Watermarked Policies). Consider the watermarked policy action āy μu + EW & with constant Σ. driving an LTI system H Hays Assume W, μ,, and measurement noise n, are mutually independent. Then the magnitude squared coherency between W and the glimpse (Cwa(ff)2 SINR())++
SINK(
Theorem 5.3
links detectability and SINR. Coherency approaches 1 when the watermark power Ps( is significantly greater than the noise power (f). The exploration scale Σ directly controls the strength of (f()); thus, policies with more exploration (larger Σ) allow for better detectability (W2
The above analysis holds in idealized (LTTI) conditions. Real robotic systems are often LTV (Linear Time- Varying), with changing dynamics (ty and scale Σ., A time-varying Σg causes "spectral smearing," reducing SINR. Furthermore, we use Short-Time analysis (Karl, 2012), assuming slow-changing system dynamics. Rapid changes, partieularly in phase, bias the coherency estimate downwards. CoNoCo mitigates this via its aggregation strategy (Section 3): (i) averaging over multiple glimpse dimensions can pick up signal from dimensions that behave more like LTI; (ii) the band B can be chosen avoid unstable frequencies. Please see Appendix C for details and practical tuning tips in Appendix D
6 EXPERIMENTAL SETUP
To evaluate CoNoCo, we design experiments covering multiple glimpse modalities and environments (Fig- ure 2. We categorize glimpse modalities based on the auditor's access (Table [T] Ground Truth Action assumes direct access to the watermarked action signal. This unrealistic setting serves as an idealized baseline,
We emphasize that Thcorems 5.2
5.2 and 5.3 are well-known properties of LTI systems Karl 2012). The contribution of
CoNoCo is in exploiting these properties design remotely detectable watermarking strategy
6

---

Published as conference paper ICLR 2026
Action
Onboard Sensoors
Trsjectory
abservation os
action oz
force
Robot
Navigation
Robollastrr Navigation
VMAS Navigation
Motion Capture
Molion Capture
Propriocepiive Messurements
Camera
Camera
Feed
robot
Aclualed Joints
HellCheelah
Figure 2: Overview of the Experimental Setup. (Left) Glimpse modalities: Ground Truth Action uses the watermarked action signal, Onboard Sensors uses readings from some onboard sensors; both assume the auditor can access some of the onboard hardware, Remote Motion Capture and Remote Camera Feed use only external sensors. (Right) Tasks: two are navigation tasks, either velocity- or force-controlled the other two are actuated joints tasks, including an Inverted Pendulum and a Legged Robot, either force- or torque-controlled.
free from the challenges (CI-C3) central to this work. Onboard Sensors use proprioceptive measurements from the robot. This modality is affected by system dynamics and noise (C2, C3), as it only estimates the effect of the actions after these are filtered by physics. Remote modalities use fully external sensors and are the main focus of this work, encompassing all challenges (C1-C3). Remote Motion Capture remotely approximates the motion of the robot using multiple cameras; its readings are unsynchronised with the policy (CI). Remote Camera Feed uses single-pov poeee-oovvooooo video recording at either top-down sideways angle; it similar to Motion Capture but typically provides less precise estimates (higher C3). Across our onboard sensor, motion capture, and remote camera settings, fa/ fa 5. Other ratios attained similar performance.
Table 1: Overview of the glimpse modalities considered in our experiments and the challenges they induce.
Challenge
Ground Truth Action
Onboard Sensors
Motion Capture
Camera Feed
C1: Sync. Uncertainty
!
C2: System Dynamics
!
!
!
C3: Interference & Noise
!
!
!
As CoNoCo is the first strategy for remote detection, no direct baselines exist. To be able perform
comparisons, we therefore introduce three adapted variants of watermarks intended for related settings: (i)
Multi-Sine Wave, inspired by replay attack detection (Ghamarilangroudi et al. 2025). embedding secret sinusoids detected via DFT energy; (ii) Correlation-Basee
embedding pseudo- pseudo-random sequence detected via normalized cross-correlation: and (iii) Tournament- Based, a novel adaptation of SynthID (Dathathri et al. 2024) extended for continuous action spaces and remote robustness. The first three strategies handle synchronization uncertainty (C1) by maximizing the detection score over grid of possible execution frequencies, while Toumament- Based does not require knowledge of the frequency and is thus not impacted by (C1). All approaches preserve the action distribution (W1). Full implementation and tuning details are Appendix
We evaluate performance using three metrics, each estimated via batch bootstrapping (40 replications for remote glimpse modalities and 100 for others):
7

---

Published as conference paper ICLR 2026
(A)
Start
Goal
CoNoCo (ours)
Non-V Men--Watrmarrked
(B)
Remote Motion Capture Glimpses
(C) Remote Motion Capture Glimpses
(D)
Remote Motion Capture Glimpses
1.0
Non Watermarked
0.8
CoNoCoo tours)
crd
CoNoCo (ours)
0.6
ComeelationBBsed
Correlation-Ban
0.4
CoNoCo
Multi-Sine Wave
Correlation Eased
Tournament-
Tournaeett Basod
0.00
0.25
0.50
0.75
1.00
20
40
Rate
Anonymity
Episode Reward
Figure 3: Results on the RoboMaster Navigation tasks. (A) Example trajectories of the watermarked and non- watermarked policies on the robot. (B) Detectability: ROC curve for 40 replications of the watermarked and non won-watermarked policy for each baseline, lines indicate median and dashed areas quartiles. (C) Anonymity: computed 1- area under the ROC curve, for detection with a different seed. (D) Reward Preservation: reward distribution of the watermarked and wotermatrrar policies.
Detectability. As raw detection scores are not comparable across strategies, we assess how reliably water- marks are detected by comparing Receiver Operating Characteristic (ROC) curve. ROC give detection rates based on the relative score obtained by watermarked and non non-watrrmarked policies.
Anonymity. A watermark should only be detectable by the intended owner. Strategies use an owner key for personalization, and detectors with the wrong key should fail. In other words, detectability should be high for the intended key k and low for an incorrect key k.. Thus, denoting AUC(k) the ROC Area Under Curve for key k. Anonymity is defined as Anonymity = AUC(K'), and higher Anonymity is better.
Reward Preservation. watermark must preserve the original policy's performance. We evaluate this by comparing the reward distributions of watermarked and -otermamrar policies.
the following, one replication refers to rumning replications of the watermarked policy and one replication of the non- non-watermarked policy. For each replication, we reset the policy, the environment, and the watermarking strategy, then generate new signal of the given modality from scratch. The detection mechanism applied independently to the outcome of each replication. To process Remote Camera Feed glimpses, convert all camera feeds into velocity estimates using Template Matching from LuNežič et al. (2018). When experimenting with remote modalities in simulation, discard all other data. Note that all the watermarking strategies considered in this work apply at inference time, meaning while the policy deployed, and do not impact RL training. Thus, the different strategies be deployed on the same pre-trained policies. In the following, we pre-train the same policies for all strategies and for each environment using Proximal Policy Optimisation (PPO) (Schulman al. 2017).
the rendered images camera feed and
7 EXPERIMENTAL RESULTS
To encode ownership, a watermarking strategy must preserve anonymity and receive a high detection score only when the auditor detects it with the secret key used during watermark generation. Our experimental results show that, among all the baselines we consider, only CoNoCo has this property. For example, we find that Multi-Sine- Sine-Wave has high detectability (as seen by its ROC curves), but really low anonymity, meaning
8

---

Published as a conference paper ICLR 2026
(A)
Ground Acuth Action Glimpses
Onboand Sensors Glimpses
Remoto Camera Feed Glimpses (B)
Onocard Sensers Glimpses
(C)
Cumulated Glimpses
1.0
1.0
2,0
Bare
Nen-Hedermarred
Navigation
OateCo frun)
Collec (surd)
Mull-Sene
Sine
Commistion londaadooddaeedd
Trumement Bosed
02o
036 não 63 1:0
6.33 6.5
1.38
4.0
936
350
13m
Ken-Welkemariad
Pendbuum
0.6
Commistion Comelstoondasedd
0.
6.2
Sine
Mull-Sin
3.0
3.00
6.25
0.50
0.5
1.00
0.00
135
0.53
0.55
1.00
1.00
0:33
0.50
6.75
1.21
20
0.5
2032
0003
Tue HalCheerish
CalieCo lount
0.4
Coed
12
CalliCo Heus
er-aaed 0.2
5.2
Nutt-Shn Mlve
Wave
30
Trams
3.0
6.25
0.50
9.75
1.00
0.00
3.25
0.53
0.75
1.00
1.00
0.23
0.50
5.75
3.50
Ancmymity
2500 5000 Epliode Raward
Figure 4: Results on a variety of Force and Torque Control tasks with increasing difficulty. (A) Detectability: ROC curve over 100 replications of the watermarked and non- watermarkee policy for each baseline, lines indicate median and dashed areas quartiles. (B) Anonymity: computed as the complement to 1 of the ROC area under the curve for detection with different owner seed, for Onboard Sensors glimpses. (C) Reward Preservation: reward distribution of the watermarked and non-watermarked policies.
that its watermark can be easily detected with the wrong secret key. The other baselines have better anonymity scores, but poor detcetability, making them infeasible. Results for more environments are in Appendix
RoboMaster Navigation. We first demonstrate our approach in real-world setting. We intentionally chose a simple task: navigating to random 2D goal. This setting is challenging because behavioural redundancy is scarce and deviations are immediately visible, narrowing the margin for imperceptible modification. Success here emphasizes that CoNoCo is viable even in straightforward tasks, not just complex systems. We train policy in simulation (VMAS (Bettini et al. 2022) ) and deploy it on the RoboMaster platform (Blumenkamp) eet al. 2024), embedding the watermark online. We evaluate the Remote Motion Capture modality and use 40 replications. with each replication collecting 50s of data (> 1000 policy calls), and resetting the target upon arrival. The results in Fig. 3 show that CoNoCo consistently performs among the best detection across modalities, while preserving anonymity and reward. The results for the same policy on the VMAS task Appendix 1.2 further show that while CoNoCo performs well in both simulation and real-world settings, other baselines degrade on the real robot. Crucially, CoNoCo succeeds despite the remote glimpse setup. The example trajectories (Fig. 3 A) confirm that the watermarked policy closely matches the non-watermarked one, showing that detectability does not induce visible behavioural changes. These results highlight the promise of CoNoCo for real-world robotics and remote detection.
Force and Torque Controlled Tasks. We next demonstrate generalization to more complex robotic systems, different control dynamics and Remote Camera Feed modality. As opposed to our real-world experiment, watermark force-controlled policies in VMAS Navigation and Mujoco Inverted Pendulum (Todorov et al. 2012), and torque-controlled policies in Mujoco HalfCheetah (Brockman al. 2016). All tasks velocity estimates glimpses, where the estimation methodology depends the
which used velocity commands,
9

---

Published as a conference paper ICLR 2026
glimpse modality. We evaluate Ground Truth Action, Onboard Sensors, and Remote Camera Feed modalities (we omit Remote Motion Capture in simulation). For limbed robots such as HalfCheetah, the glimpses are the joint angular velocity, which we remotely estimate from a side-way way camera feed by combining linear velocity estimates of the two extremities of each limb. We validate the watermarks across 100 replications. Data collected per replication: Navigation: 50s (<z 1000 calls); Pendulum: 25s ( 1000 calls); HalfCheetah: 50s ( 1000 calls). Results are shown in Fig. 4 Across all tasks and glimpse modalities, CoNoCo achieves near-perfect detectability, despite the additional complexity of the tasks. This performance is only matched by Multi-Sine Wave, which, however, fails anonymity. Importantly, CoNoCo also obtains high detectability using Remote Camera Feed. This result highlights the promise of CoNoCo for more complex robotic tasks.
Glimpse sequence length sensitivity. Our experimental results in this section assume fixed glimpse sequence length. However, CoNoCo's detection quality correlates with glimpse sequence length, eventually converging on perfect detection (ROC AUC 1). To understand how much data is required to reliably detect the watermark in our real robot experiments and each of our simulated environments, we examine CoNoCo's performance with respect to different glimpse sequence lengths. Our findings are presented in Appendix F
Adversarial Attacks. Beyond the inherent challenges of remote detection, it is helpful for a watermarking scheme to be robust against deliberate attempts by an adversary remove the signature. In Appendix H we consider a number of such strategies, including white noise attacks, and jamming strategies specifically targetting the secret band B. We find that CoNoCo highly robust to such attacks: either they degrade policy performance, or they are unable to significantly harm detection. We also discuss (but do not experiment with) the feasibility of distillation as an adversarial attack.
8 CONCLUSION
Remotely detectable robot policy watermarking is an important capability for IP protection and safety certifi- cation in real-world robotics. We formalized the fundamental challenges posed by this type of watermarking. and proposed Colored Noise Coherency (CoNoCo), a robust, performance-presete designed for remote physical data. Our experiments, spanning different robot types and remote modalities, demonstrate that CoNoCo can successfully detect physical watermarks from remote data. Our results demon- strate how robot policy provenance can be verified non-invasiveel, paving the way for trustworthy deployment and accountability in real-world robot systems. We discuss open questions and limitations in Appendix A
watermarking strategy
9 ACKNOWLEDGEMENTS
This work is supported by European Research Council (ERC) Project 949940 (gAla), and by the EPSRC funded INFORMED-AI project EP/Y028732/1. We gratefully acknowledge their support.
REPRODUCIBILIT STATEMENT
We open-source our code at stttps://gitiin http:///....p.ooooo/////oooooooa
including the code used to train the policies, generate, inject, and detect the watermark across all tested modalities. The documentation linked in the README contains detailed instructions on how to reproduce the results and figures in this work. We also include the trained policies themselves, to enable exact replication of our simulation results. We designed this codebase to be straightforward to install and use, so that new users can easily implement new watermarking strategies and test them on environments try and beat proposed approach.
All mathematical theorems claimed in this work are proven in the Appendix.
10

---

Published as a conference paper ICLR 2026
REFERENCES
Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In 27th USENIX security symposium (USENIX Security 18), pp. 1615-1631, 2018.
Vahid Behzadan and William Hsu. Sequential triggers for watermarking of deep reinforcement learning policies. arXiv preprint arXiv: /906.01 /26, 2019.
Hal Berghel and Lawrence O'Gorman Protecting ownership rights through digital watermarking. Computer, 29(7):101-103, 1996.
Mattco Bettini, Ryan Kortvelesy, Jan Blumenkamp, and Amanda Prorok. Vmas: A vectorized multi-agent simulator for collective robot learning. In International Symposium on Distributed Autonomous Robotic Systems, pp. 42-56. Springer, 2022.
Jan Blumenkamp, Ajay Shankar, Matteo Bettini, Joshua Bird, and Amanda Prorok. The robbbraggrobbomaasssse An agile multi-robot research platform. arXiv preprint orXiv:2405.02199, 2024.
Greg Brockman, Vicki Cheung, Ludwig Pettersson, Jonas Schneider, John Schulman, Jie Tang, and Wojciech Zaremba. Openai gym. arXiv preprint arXiv: 2016.
Kangjic Chen, Shangwei Guo, Tianwei Zhang, Shuxin Li, and Yang Liu. Temporal watermarks for deep reinforcement learning models. Proceedings of the 20th international conference on autonomous agents and multiagent systems, pp. 314-322, 2021.
Jang Hyun Cho and Bharath Hariharan. On the efficacy knowledge distillation. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 4794-4802, October 2019, doi: 10.1 D0.1009/CCCV.20199004499
Ingemar Cox. Joe Kilian, F Thomson Leighton, and Talal Shamoon. Secure spread spectrum watermarking for multimedia. IEEE transactions on image processing. 6(12):1673-1687, 1997.
Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar, Deepsigns: An end-to-end watermarking frame- work for ownership protection of deep neural networks. In Proceedings of the twenty-fourth international conference on architectural support for programming languages and operating systems, pp. 485-497, 2019.
Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, al. Scalable watermarking for identifying large language model outputs. Nature, 8 8-8323, 2024.
Azam Chamarilangroudi, Shahin Hashtrudi Zad, and Youmin Zhang. Replay attack detection using switching multi-sine watermarking, In 2025 33rd Mediterranean Conference on Control and Automation (MED), pp. 381-386. IEEE, 2025.
David Hoeller, Nikita Rudin, Dhionis Sako, and Marco Hutter. Anymal parkour: Learning agile navigation for quadrupedal robots. Science Robotics, 988):ead)7566, 2024.
Kaibo Huang, Zhongliang Yang, and Linna Zhou. Agent guide: A simple agent behavioral watermarking framework. arXiv preprint arXiv:2504.05871, 2025.
John H Karl. An introduction to digital signal processing. Elsevier, 2012.
11

---

Published as a conference paper ICLR 2026
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, lan Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pp. 17061-17084, PMLR, 2023.
Charles Knapp and Glifford Carter. The generalized correlation method for estimation of time delay. IEEE fransactions on acoustics, speech, and signal processing, 24(4):320-327, 2003.
Woo-Hyun Ko, Bharadwaj Satchidanandan, and PR Kumar. Theory and implementation of dynamic water- marking for cybersecurity of advanced transportation systems. In 2016 IEEE Conference on Communica- tions and Network Security (CNS), pp. 416-420. IEEE, 2016.
Joonho Lee, Jemin Hwangbo, Lorenz Wellhausen, Vladlen Koltun, and Marco Hutter. Learning quadrupedal locomotion over challenging terrain. Science robotics, 5(47)xeabc5986, 2020.
Timothy P Lilliccaap, Jonathan J Hunt, Alexander Pritzel, Nicolas Heess, Tom Erez, Yuval Tassa, David Silver, and Daan Wierstra. Continuous control with deep reinforcement learning. arXiv preprint (tf:::1509009777. 2015.
A LuNežič, Tomá's Vojíř, L Čehovin Zaje, Jifí Matas, and Matej Kristan. Discriminative correlation filter tracner with channel and spatial reliability. International Journal of Computer Vision, 126(7):671-688 2018.
Bharadwaj Satchidanandan and Panganamala R Kumar. Dynamic watermarking: Active defense of networked cyber-physical systems. Proceedings of the IEEE, 105(2):21-240, 2016.
John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. Proximal policy optimiza- tion algorithms. arXiv preprint arXiv:1707. 000007770.47..... 2017.
Laura Smith, Ilya Kostrikov, and Sergey Levine. Demonstrating walk in the park: Learning to walk in 20 minutes with model-free reinforcement learning. Robotics: Science and Systems (RSS) Demo, 2(3):4, 2023.
Mitchell D Swanson, Mei Kobayashi, and Ahmed H Tewfik. Multimedia data-embedding and watermarking technologies. Proceedings of the IEEE,
1998.
Sebastian Szyller, Buse Gul Atli, Samuel Marchal, and N Asokan. Dawn: Dynamic adversarial watermarking of neural networks. In Proceedings of the 29th ACM international conference on multimedia, pp. 4417- 4425, 2021.
Emanuel Todorov, Tom Erez, and Yuval Tassa Mujoco: A physics engine for model-based control. In 2012 IEFF/RSJ international conference on intelligent robots and systems, pp. 5026-5033. IEEE, 2012.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint 2rX1v:2305.220000 2023.
A OPEN QUESTIONS AND LIMITATIONS
As shown in our theoretical analysis and experiments, the CoNoCo watermark is robust to different policy behaviours, glimpse modalities, and robot types (e.g., legged or wheeled). Nevertheless, it is limited by the quality of the glimpse data it receives, which may be even less clean in real-world settings than in experiments. In Appendix G we provide an empirical study of the sensitivity of detection to various forms of glimpse alteration. In all our experiments, or view camera that had full visibility at all times. In many real-world scenarios, however, robots may be partially obscured due other moving bodies, camera angles self-occlusion. Such setups would
could record the robots' movements with stationary side-view
12

---

Published as conference paper ICLR 2026
make it challenging to extract reliable motion glimpse estimates. Addressing this limitation would require more advanced computer vision techniques, which are beyond the scope of this work and are left for future study. Addressing these challenges will significantly broaden the applicability of CoNoCo unpredictable, real-world domains.
CoNoCo designed around policy stochasticity, which provides the variability needed embed and recover the watermark. Applying the method to deterministic policies would require adapting these ideas to alternative sources of variability. We view this as a natural and promising extension of our framework and leave it for future work.
B USE OF LLMS
We used LLMs (Gemini and ChatGPT) to discover references related work, well polish some parts of the writing. We read all suggested references ourselves and verified their relevance.
CoNoCo IN LTV SYSTEMS
Real robotic systems often deviate from the idealized L.TI (Linear Time-Invariant assumptions, presenting LTV (Linear Time- Varying systems with changing dynamics (t) and exploration scale Σg. This presents two main challenges and corresponding mitigation strategies employed by CoNoCo.
C.I TIME- VARYING EXPLORATION SCALE (Ex)
The Challenge: Spectral Smearing. The watermark W; is scaled by the policy's exploration scale Σg. Σs changes rapidly (e.g.. the robot suddenly switches from cautious exploration to decisive movement), it modulates the amplitude of the watermark. This modulation (like rapidly changing the volume specific tone) spreads the energy of Wa outside the secret band B. This effect, known "spectral smearing." reduces the detectable signal energy within the band, lowering the SINR and making detection harder.
Mitigation. CoNoCo works best when Eg evolves slowly. We find it robust to this effect empirically, achieving high detection rates despite varying exploration scales in all our experiments. However, if Eg evolves abruptly, potential mitigation strategy (which we do not employ in this work) is to replace Σ, with a moving averaage of the last several exploration scales: Σg. This smooths the modulation, reducing spectral smearing and improving detection. This introduces trade-off: larger averaging windows improve detection but may slightly impact policy performance if the responsiveness of the exploration scale is critical.
C.2 LTV DYNAMICS AND ESTIMATION CHALLENGES
The Challenge: Phase Variation and Estimation Bias. Coherency formally defined for LTT systems, where the relationship (including the timing, phase) between input and output is constant. CoNoCo analyzes the signals of real-worts wolld LTV systems using Short-Time analysis (implemented via Welch's 's method), which divides the signal into short windows. If these dynamics change over time, particularly the phase relationship between the input (watermark) and the output (glimpse), this averaging can lead to cancellation (destructive interference) of the Cross-Spectus Density (CSD). This cancellation biases the coherency magnitude estimate downwards, making the watermark harder to detect. This a known limitation when analyzing LTV systems.
time. In particular, if the system is approximately LTT within each window, the detection signal will be stronger. However, CoNoCo also has number of mitigation elements that improve its robustness when this is not the case:
Mitigation. CoNoCo works best when the system dynamics do not change
13

---

Published as a conference paper ICLR 2026
(i) Multi-Dimensional Averaging (Spatial Diversity). The final detection score (Section is calculated by averaging the magnitude of the different physical dimensions D. Complex robots are typically monitored through multiple sensors or observation dimensions (e.g., different joint angles, velocities, or viewpoints in a camera feed). It is unlikely that all dimensions are affected equally by time-varying dynamics. Some physical dimensions may behave much more linearly (LTI-like) than others. By averaging the detection scores across all available dimensions, CoNoCo exploits this spatial diversity. Strong detection signals from the well-behaved, more linear dimensions can ensure successful watermarking, even other dimensions provide weaker signal due to strong LTV effects. Furthermore, while not explored in this work, one could potentially improve detection further by identifying and censoring dimensions that exhibit highly non-linear behavior.
(ii) Strategic Band Selection (B). The design of CoNoCo allows the owner to choose the secret frequency band B. This band can be strategically selected to target frequencies where the robot's physical response is known to be relatively stable, predictable, and linear (more LTI-like). Conversely, we can avoid frequencies associated with highly unstable or rapidly changing dynamics (e.g., resonant frequencies behaviors involving abrupt contact changes) where the LTV effects are most pronounced (see Appendix D
D TUNING CoNoCo
In general, we find that CoNoCo is fairly robust and works "out of the box" when given sufficiently long glimpse sequences. However, in cases where the glimpse sequences are very short, or in rare cases where we observe that policy performance is impacted by the autocorrelation introduced by the watermark injection, detection and performance can be improved by tuning the frequency band B and the window length of Welch's s method Tuin-
B should be selected to not interfere with the policy performance and ideally, interact with the system dynamics and policy as little as possible: this might mean omitting low frequencies (if the policy varies smoothly), high frequencies (if the policy varies highly and requires precision). Twin should be selected based on the length of the glimpse sequence. When fg/f= = and we observe 1000 policy calls so the glimpse sequence has length 5000-we find Twin 64 to work well. When the glimpse sequence is of length 20000 or more, T win 256 works best. For intermediate values, Twii = 128 may work.
In the of the VMAS Velocity Navigation environment, we found that the glimpse sequence length of 5000 (1000 policy steps at too large. Setting the window to T Twin- 64 attained almost perfect detection results.
ratio of 5) meant that our default window of Twin = 256
In the case of the Pendulum environment, we found that using the band B = [1.2, 2.49] was interfering with the policy performance (but watermark detection). Reducing the higher frequencies by setting = [0.1, 1.5] made the policy perform equivalently to its non-watermarked variant while not harming detection.
E BASELINE WATERMARKING STRATEGIES
To the best of our knowledge, our proposed watermarking strategy is the first that enables remote detection. As no direct baseline exists for this setting, we introduce adapted variants of prior watermarking methods, which, although not originally designed for remote detection, serve the most relevant points of comparison.
Multi-Sine Wave. Inspired by techniques used for replay attack detection (Ghamarilangroudi et al. 2025). this strategy embeds watermark by synthesizing signal composed of a sum of multiple sinusoids. The owner key defines the secret frequencies and signs of these sinusoids within a specific band. This synthesized signal, normalized to preserve the policy's 's action distribution (W1), replaces the standard exploration noise.
14

---

Published as a conference paper ICLR 2026
Detection is performed in the frequency domain. The detector calculates the energy of the observed glimpses at the secret frequencies using Discrete Fourier Transform (DFT). The detection score is the signed sum of these energies. maximized over a search grid of possible policy execution frequencies address synchronization uncertainty (CI).
Correlation-Basel This strategy embeds a watermark by replacing the policy's exploration noise with a secret pseudo-random sequence. For detection, the glimpses are first high-pass filtered to isolate the watermark signal from the primary behaviour (C3). The detector then calculates the normalized cross-correlation between the filtered glimpses and the hypothesized watermark signal, maximizing this score over range of possible policy execution frequencies to handle synchronization uncertainty (CI).
fournament-Baseee SynthID (Dathathri al. 2024 is tournament-basee method for watermarking that represents the state of the art in watermarking LLMs. However, the token generation setting used in SynthID differs from ours in two respects: (1) the support of the token distribution is discrete, and (2) detection is not remote, as the exact L.LM output is always available to the detector. We therefore introduce a variant, which we term Tournament-Bant Based,, designed to: (1) extend to distributions with continuous support, and (2) enable remote detection by (2.i) ensuring robustness to noise through assigning similar scores to neighbouring actions, and (2.ii) relying exclusively on information available in the glimpses when selecting watermarked actions, so it can be inverted for detection. One round of Tournament-Basee proceeds as follows. First, N actions are sampled from the policy distribution for the current timestep, which enables (1). These N actions encounter a tournament, where the winner of each duel is determined using scoring functions known as g-functions. Here, to enforce property (2.i), we use Bell-shaped g-functions, with the parameters of the Bell-curve sampled using a context-dependent random key. To enforce property (2.ii), we choose this random key as the norm of the observation that will later be available through glimpses (c.g. velocities). The owner key is used to build the continuous function that is sampled to get the g-value parameters.
We tuned all of these watermarks, including CoNoCo, by rerunning our experimental suite a few dozen times the Delocity-commane VMAS Navigation (Appendix [.2] and small handful of times on the other environments. We updated the parameters by hand after each attempt, optimizing for detection AUC. In all methods except the tournament-base based method, hyperparameter of interest is the granularity of the search for the hypothesized true frequency fpi (see Algorithm D For Multi-Sine Wave, the additional relevant parameters are the band B (similar to CoNoCo), the number of sinusoids. To tune B, we followed the same recommendations as for CoNoCo, described in Appendix D For the tournament- based method, the choice of g function and the number of tournament layers was tuned.
Full implementation and hyperparameter details are available in our code repository.
F GLIMPSE SEQUENCE LENGTH SENSITIVITY
In Figure we analyze how the number of timesteps in the glimpse sequence influences watermark de- tectability across environments. Detectability is measured using the Area Under the ROC Curve, where a value of 1.0 indicates perfect classification. This analysis quantifies the amount of data necessary for reliable detection of the watermark in each environment. Across most environments, detectability saturates at roughly 1000 timesteps. These results determine the glimpse length used in our main experiments, ensuring that all evaluations operate in a regime of near-maximal detectability.
G GLIMPSE ALTERATION SENSITIVITY
This section studies the sensitivity of CoNoCo to various glimpse alterations to assess its robustness.
15

---

Published as a conference paper ICLR 2026
RoboMaster Navigation
Force- Corce-Controlied Navigation
Pendulum
HalfCheetah
1.0
0.9
Area under the ROC
0.8
0.7
0.6
1000 2000 2000 4000 5000
0
5000
10000
0
5000 10000
0
5000 10000
Evaluation Length (Timesteps)
Evaluation Length (Timesteps)
Evaluation Length (Timesteps)
Evaluation Length (Timesteps)
Figure 5: Relationship between glimpse sequence length and the watermark detectability of CoNoCo. Detectability is reported as the ROC AUC averaged over 10 repetitions. We use the Onboard Sensors glimpse modality, except for "RoboMaster Navigation," where instead use real-world data from our robot experiments with Motion Capture glimpses. Shaded regions indicate quartiles.
G.1 ROBUST OFFSET SYNCHRONIZATION VIA GCC-PHAT
An important challenge in remote auditing (C1) is the unknown time offset: the auditor may begin observing the system (e.g., via CCTV footage) long after the robot started operating. The standard CoNoCo detection algorithm (Algorithm D assumes the glimpse sequence G' starts near the beginning of the policy execution (Line 7: W - W : G), d). If there is a large offset т, the alignment is lost, causing detection to fail.
This can be robustly handled with simple change to CoNoCo, by the Generalized Transform (GCC-PHAT) (Knapp & Carter 2003) to estimate and correct for the time offset r. GCC-PHAT is technique for estimating the time delay between two signals. Standard cross-correlation is sensitive to system dynamics (C2), as the robot's physics distort the signal amplitude. In contrast, GCC-PHAT makes the (LTTI) system dynamics, mirroring the invariance property of Spectral Coherency (Theorem 5.2). As GCC-PHAT is well-known, we refer to (Knapp & Carter 2003 for the details.
Phase
synchronization process invariant to Linear
Implementation. For each frequency hypothesis we calculate the GCC-PHAT curve between the glimpses and the resampled watermark W within the secret band B. For MIMO systems, we aggregate these curves across dimensions (Lines 6-10) to find a robust consensus offset + (Line 11). Finally, the coherency score is calculated on the synchronized segments (Lines 12-19).
Empirical Validation. The results in Figure 6 demonstrate the effectiveness of this enhancement. In all experiments, standard CoNoCo's performance degrades rapidly as the offset increases, whereas CoNoCo-Of feeto-offett-aamne i in maintains near-perfect detection (AUC z 1.0) even for substantial off- sets. This confirms that CoNoCo can be readily adapted for realistic auditing scenarios involving arbitrary observation start times.
G.2 ROBUTNESS TO TIME-JITTER
Another important challenge in real-world glimpses is time-jitter, which corresponds to inconsistent intervals between glimpses within a sequence. Such jitter can arise either at the policy level, where the policy is queried at slightly inconsistent time intervals (due to hardware constraints, network traffic, etc.), or the glimpse-acquisition level, where the sensor captures glimpses at slightly inconsistent intervals (due to the properties of the specific sensor at hand). We measure jitter the relative standard deviation of the glimpse
16

---

Published as conference paper ICLR 2026
Algorithm 2 Watermark detection with offset handling via GCC-PHAT (CoNoC--Offset-Fand) ing)
Require: Glimpses G. Glimpse Freq fa. Key K {S, Search Range Freuch Max Offset mius
< NumDimensionsi(G]; BestScore
Wease + RegenerteWWermmrkkSpppneeeee
Length = [GI/fg + max))
3: for E seunch do
4: W" f- ResamplcPolyyWasse:f
CCCagg
Offsct handling starts here
for
7:
CCCa + CalculaecccCPHATT((C; Wi[: d]][:d],.. fa.
8:
CCCugg +- CCCagg + CCCa
9:
it argmax (ggaa((CCCog)
> Find consensus offset across the D dimensions. Offset handling ends here! b Rest of the detection algorithm remains the same.
10:
Waligned W. f: Gi]
11:
Scoresum
12:
for d to
13:
C. &- Coherency (Gl: [. d]. W d.
14:
Scorea <- Mean( (Abs (Abs(Calf E BJ)
15:
Scoresum Score
Scorea
16:
Score D > BestScore then
17:
BestScore +- Scoresum D
18:
return BestScore
Velociiy Navigation
Force-Contrelled Navigation
HalfCheetah
1.0
Area under the ROC curve
0.8
0.8
0.8
0.6
0.6
0.6
0.4
0.4
0.2
0.2
0.2
CoNoCo
CoNbCo-offtet+Handing
0.0
0.0
0.0
100
150
200
100
150
200
50
100
150
200
50
100
150 200
Obaess--bbservtionn Offset
Clmmpse-Obeeraation Offset
Offset
Glimpse-Observation Offset
Figure Relationship between glimpse offset and the detectability of CoNoCo (Algorithm and CoNoCo-Off wot-oofffsetaannlll.. ing (Algorithm{), 2 Detectability is reported the ROC AUC over 100 repeti- tions, using the Onboard Sensors glimpse modality, Shaded regions indicate quartiles.
interval. For example, jitter of 0.2 for glimpses at frequency 100Hz means that the interval between two glimpses drawn from a normal distribution with mean 1/100 0.01s and std 0.2/ 100 0.02s.
We study the effect of increasing jitter CoNoCo in Figure 7 For comparison, quantify the time jitter in our main experimental results and find a
the Remote Motion Capture Glimpses collected on RoboMaster value of 0.002, which include as reference in the figure. The results demonstrate that CoNoCo remains robust under levels of jitter significantly higher than those observed in our real-world system.
G.3 ROBUSTNESS DROP OF GLIMPSES
Another alteration that impact detection in real-world settings is glimpse-drop, where proportion of the glimpses is missed at random point during detection. We study the sensitivity of CoNoCo to such drop by removing increasing number of
glimpses across tasks. The results in Figure show that
17

---

Published as conference paper ICLR 2026
Velocity Controlled Navigation
Force Contralled Navigation
Pendulum
HalfCheetah
1.0
1.0
1.0
Area under the ROC curve
0.8
0.8
0.6
0.6
0.6
0.4
0.4
0.4
0.2
CoNoCo
RoboMaster WorldWorld Jitter
0.2
0.4
0.6
0.0
0.2
0.4
0.6
0.0
0.2
0.4
0.6
0.2
0.4
Glimpse Time-Jitter
Glimpse Titte STD
Glimpse Time-jitter
Glimpse Time-Jitter STD
Figure 7: Relationship between glimpse time-jitter and the detectability of CoNoCo, reported as the ROC AUC over 100 repetitions, using the Onboard Sensors glimpse modality. Shaded regions indicate quartiles. The vertical red line denotes the actual time jitter quantified in our experiments on the RoboMaster platform.
Velocitty-onttroled Navigation
Forte-Controlled Navigation
Pendulum
HalfCheetah
1.0
1.0
1.0
Area under the ROC curve
0.8
0.8
0.6
0.6
0.6
0.4
0.4
0.2
0.2
0.2
0.2
CoNoCo
0.0
0.0
0.0
0.0
50
100
150
200
0
50
100
150
200
50
100
150
200
50
100
150
200
Glimpse Drop (timestops)
Glimpse Drop (timesteps)
Glimpse Drop (timesteps)
Glimpse Drop (timesteps)
Figure 8: Relationship between glimpse drop and the detectability of CoNoCo, reported as the ROC AUC over 100 repetitions, using the Onboard Sensors glimpse modality. Shaded regions indicate quartiles.
CoNoCo remains robust to glimpse-drop up to 200 frames, which represent 20% of frames in the Navigation and Pendulum tasks and 5% in the HalfCheetah tasks.
G.4 ROBUSTNESS TO REMOTE GLIMPSES SHIFT
When using remote auditing (CI), another potential challenge in real-world scenarios is that the camera or sensor may be slightly shifted relative to the side-view or top-down view adopted in our experimental setup. We study the robustness of CoNoCo to this type of alteration by projecting the glimpses onto planes that are slightly shifted with respect to the original one. In Figure 9 we present this analysis for the waal-wrrld RoboMaster data and report how the ROC AUC evolves the angle between the original and projected planes increases. We report the angles as tuples of two elements, containing the rotations along the x and y axes with respect the original glimpse plane. Our results highlight that the detection performance of CoNoCo is only affected for very large angular deviations from the original plane (greater than 60' along both and y), indicating strong robustness to such shifts.
18

---

Published as conference paper ICLR 2026
RoboMaster Navigation
1.0
Area under the ROC curve
0.8
0.6
0.4
0.2
0.0
15:
60
75
15
30
15
50
60.60
30.7
45:
45.15
45,
44
60.0
60115
60.30
60
60.60
60,
75
75.15
75:30
75
75.75 75.75
Projection
CoNoCo
Multi-Sine Wave
Correlation-Based
Toumament-Based
Figure 9: Relationship between Motion Capture Glimpses Shift Angle and the detectability of CoNoCo. Angles are specified as tuples of the and axes rotations (in degrees). Detectability is reported the ROC AUC over 100 repetitions, using the Motion Capture Glimpses modality. Shaded regions indicate quartiles.
H ADVERSARIAL ROBUSTNESS ANALYSIS
We consider threat model where the adversary is the Policy User (Figure T. detection while preserving the utility of the stolen policy āt. We assume the adversary does not possess the secret key K.
Step 2), aiming evade
We first consider robustness to additive noise. Then, because CoNoCO uses Colored Gaussian Noise (CGN), it alters the spectral distribution of the actions. We acknowledge that sophisticated adversary analyzing long-term spectral averages might be able to localize the secret band B. We analyze the strategies the adversary might employ if they identify the band. We show that learning the band is generally unhelpful. We finally discuss distillation/ behaviour cloning as possible vehicle for IP theft.
H.1 ROBUSTNESS ADDITIVE NOISE ATTACKS
Additive Noise Attack (Randomized Smoothing). We consider the effects of an Additive Noise Attack. The adversary adds White Gaussian Noise (WGN) to the actions before execution:
d Clip (as + Nadu).
(I)
where Madu ~ (O, Ldd I). and the clipping ensures the actions remain within the environment's 's physical bounds. The standard deviation oadu represents the adversary's 's strength or budget.
This attack directly impacts detectability by introducing an additional source of noise into the system. Refer- ring the analysis in Section 5, the addition of Maad increases the overall noise power Pv (f), consequently reducing the Signal-to-Interfereenn het--nnteffrrenc-pluu----- Soonnceplu--Noiss Ratio (SINR) (Definition 5.1). According to Theorem 5.3, this directly lowers the expected magnitude of the coherency, making detection more difficult.
Evaluation and Results. To evaluate CoNoCo's robustness, simulate this attack the Inverted Pendulum and HalfCheetah tasks, varying the adversarial strength Fade from 0 to 2. We analyze the trade-off between the reduction in the detection scores and the degradation in the policy's reward. The results, shown in
19

---

Published as a conference paper ICLR 2026
Inverted Pendulum
HalfCheetah
2.0
05
6.9
-8
63-
Nome lood Roward
Detection AUC
0.0
Nomm Davd Rowand
6.8
Detection
Cetect on ALC
Dettct or ALC
Nomma und Rawurd
Narno usd fowaed
0.7
0.8
6.5
655
Strength
Adversary Strength
Figure 10: Adversarial robustness results for additive noise attacks (results over 10 repeats). Each subfigure shows detection scores and normalized policy reward as function of adversarial noise strength adv ranging from O to 2. Normalized reward means the ratio of reward at each adversary strength to the baseline reward. The plots demonstrate CoNoCo's 's resilience, with detection persisting under high noise in HalfCheetah, while requiring severe reward degradation to evade detection in Inverted Pendulum.
Figure 10, demonstrate that CoNoCo is strongly robust to this type of adversarial attack. In the HalfCheetah task, both detection AUC and policy reward degrade gradually as Gade increases, but the watermark remains consistently identifiable up adde 2. This is particularly robust given that, aade 2, the added adversarial noise overwhelms the policy's s original actions, yet detection persists. In contrast, for the Inverted Pendulum task, even modest adde 0.25 severely degrades both detection and reward, indicating that the attack cannot evade watermarking without rendering the policy ineffective. Overall, these findings show that additive noise attacks perform poorly against CoNoCo, evading detection requires noise levels that destroy the policy's 's value, demonstrating its robustness.
H.2 ADVERSARIAL FILTERING ATTACK (BAND-STOP)
If the adversary has successfully learned B, a direct attack is to apply a band-stop (notch) filter Hetop the actions d'g = H (.x)) While this successfully attenuates the watermark Wx, the filter is applied to the entire action, meaning also removes components of the original policy behavior μu within B.
This acts as self- self-jamming. If the band B contains frequencies important for the robot's task performance, this filtering degrades the utility of the stolen policy.
We demonstrate this trade-off in a numerical experiment (Figure IT where the policy behaviour partially intersects the secret band. Roughly speaking, x: of the frequency content of a policy μl lies inside the secret band B, and we apply a filter to completely dampen this band, the distortion (Mean Squared Error) between the intended policy behaviour μ4 and the executed action af, will 2%, harming performance.
To demonstrate this, we consider synthetic policy μa, generated from colored Gaussian noise with 60% of its signal intersecting the secret band B, and 40% of its signal intersecting another, arbitrary frequency band. As the filter strength increases, the watermark detection score drops, but the distortion (Mean Squared Error) between the intended behavior μa and the executed action af increases significantly. In our simulation, applying a strong filter increased policy distortion to 37.5% relative the baseline. Since almost all policies will intersect with the secret band B to some extent, this demonstrates that band-stop adversarial attacks against CoNoCo come at significant performance cost, defeating the point of such adversarial methods.
20

---

Published as conference paper ICLR 2026
Adversarial Trade-off: Band-Stop Filtering Attack
0.38
0.375
Watermark Detection Score (Coherency)
0.350
0.36
0.325
Distortionn
0.34
0.300
0.275
0.32
0.250
0.30
0.225
0.200
0.28
Adversarial Filter Strength (Butterworth Ordert [O=No Filter]
Figure 11: Adversarial Trade-off for Band-Stop Filtering Attack. As the adversary increases the filter strength (Order), the watermark detection score (Blue) decreases, but the distortion (MSE) to the original policy behavior (Red) increases dramatically (by 257% in this simulation), demonstrating the degradation of policy utility.
H.3 RL-BASED STRUCTURED JAMMING
One might consider an approach wherein some RL agent learns a structured jamming signal Jj to interfere with the watermark. Optimal interference implies cancellation (Jx x WR)... However, this rigorously impossible without the secret key. Cancellation requires predicting the instantaneous value (phase) of the pseudo-random signal Wx. Since the adversary does know the key (the seed for Wa), Wi. and the learned jamming signal Js are independent, zero-mean stochastic processes. Mathematically, the variance (power) of the sum is the sum of the variances: Var(W) (w J) Var(W) + Var(J). The power always increases.
We verified this numerically and visualize it using Power Spectral Density (PSD) in Figure 12 signal power (Red) is the sum of the individual powers (Blue and Green), confirming that the signals add rather than cancel. Therefore, the adversary cannot implement structured cancellation. Their best strategy reverts to the Additive Noise Attack analyzed in Section H.I
The combined
H.4 POLICY DISTILLATION
Policy distillation might remove the watermark as side-effect of the imperfect approximation. While potentially effective, we outline two possible challenges when deploying such approaches:
IP-sensitive policies, such as foundation models and autonomous driving policies, are often trained on vast amounts of diverse and proprictary real-world data (sometimes gathered from different robots and task types) and synthetic (simulator) data. It is not necessarily feasible or cost-effective for our adversary distil the original policy purely by collecting data from deploying such policies single robot, handful of robots, or even an API (which may include rate limits or incur significant usage costs at the scale required for distillation).
21

---

Published as conference paper ICLR 2026
PSD Analysis of Structured Jamming Attempt
Secret Band B
1.75
Watermark (Owmer Seed)
Jamming tna (Adversary Seed) W+]
1.50
Power Spactral (P50)
1.00
0.75
0.50
0.25
0.00
Frequency [Ht)
Figure 12: PSD Analysis of Structured Jamming Attempt. The Watermark (W) and Jamming signal (J) are generated with different seeds. The power of the combined signal (W+J) is the sum of the individual powers, confirming that cancellation is impossible without the secret key.
2. Building the above, since distillation is an imperfect approximation, it often leads to performance drop. reducing the value of the stolen (e.g.. Hariharan (2019))
We conclude that, while distillation may be an effective method against watermark, it requires specific conditions to be an attractive adversarial method against CoNoCo.
T RESULTS ON ADDITIONAL ENVIRONMENTS
L.1 RESULTS ON CORCE-CONTROLLE VMAS NAVIGATION WITH OBSTACLES
We introduce an additional environment: Force-Controlly VMAS Navigation with dynamically resampled obstacles. In this setting, the agent navigates among eight obstacles whose positions randomly resampled each time the agent reaches the goal, resulting in multiple reconfigurations per episode. We choose this environment because its cluttered layout intrinsically constrains the policy's exploration noise during certain phases of the task. Our aim is to evaluate whether CoNoCo remains effective under such limited-variance conditions. The results, shown in Figure [3] indicate that CoNoCo maintains strong detection performance, demonstrating its robustness even in low-variance environments.
I.2 RESULTS ON VELOCITY- CENCCITY-CONTROLLEE VMAS NAVIGATION
We provide in Figure 14 the results for the Celocit--Controllc VMAS Navigation task. The policy used here is also the deployed the RoboMaster in the main results. The results show that baselines that got low detectability on the real robot are getting better results on the simulated task. CoNoCo highly successful both the real and simulated task.
22

---

Published as a conference paper ICLR 2026
(A)
(8) Drount Truth ontio Glimpses Orbooee Secoarrs Gämpous Pamole Comera Feed Gämpres (C)
Ontoond Serverrs C3 Clmpposs
(S)
Garrdeteed Gimpanx
Chocaele bargptam tore
Colece beni
14
Cencle doodd
Cormiit andwect
Mals Wive
Pall New Mave
+
Bosed
To Tamara toaiee
a59 E3s eie 0.5 1.0
3.2
8.55
036 0.5. 130
0.00 0.2 233 655 1.0
0.5
Figure 13: Results on the of the environment. The blue dot represents the agent, the black dots denote the obstacles, and the line shows an example trajectory. (B) Detectability: ROC curve for 100 replications of the watermarked and non-watermarked policy for each baseline, lines indicate median and dashed areas quartiles. (C) Anonymity: computed as the complement to of the ROC area under the curve for detection with a different owner seed, for Onboard Sensors glimpses. (D) Reward Preservation: reward distribution of the watermarked and non-watermarker policies.
Controlled VMAS Navigation with Obstacles task. A) Visualization
[A] Ground Truth Action Giimeees
Onboard Sensors Glimpees Remote Camera Feed Gimpess, (B)
Onboard Sensors Glmppes
(C)
Cumulated Glimpses
Nav Vecctt
Coticoo lousl
0.1
Coriciion Besol
Comdation Baxd
-02
Contictor Saxt
0.2
Vuli-Gie Wive
Nall
0.5
3.0
0.7
633
8.25
0.20
3.75
1.00
0.50
0.35
0.33
0.75
1.00
0.03
2:25
3.50
0.75 1.00
Epluste Sewanr
Figure 14: Results on the Gelociy--Contrllie VMAS Navigation task. T(A) Detectability: ROC curve for 100 replications of the watermarked and non- watermarked policy for each baseline, lines indicate median and dashed areas quartiles. (B) Anonymity: computed as the complement to 1 of the ROC area under the curve for detection with different owner seed, for Onboard Sensors glimpses. (C) Reward Preservation: reward distribution of the watermarked and non-watermarked policies.
J PROOF OF THEOREM 5.1 (MARGINAL DISTRIBUTION PRESERVATION)
Proof of Theorem 5.7 Marginal Distribution Preservation). Let H be stable LTI filter with impulse re- sponse }. The input is sequence of independent and identically distributed (i.i.d.) White Gaussian Noise Xx (0, 1). The raw filtered output W is given by the convolution:
WITH = (H+
= Σ
Kr
j=-00
1. Gaussianity: Since the input variables XR-j are jointly Gaussian (due to independence), and Wrta is a linear combination of these variables, WTa is also a Gaussian random variable.
2. Mean:
We calculate the expected value using the linearity of expectation:
E W = E
Σ h N
= Σ F
(3)
Since E[Xx] = 0 for all k we have ElWT.M]
0.
23

---

Published as conference paper ICLR 2026
3. Variance: We calculate the variance. Since the mean is zero, [arlW
B((W )
Σ h KR- )
Var E
Σ
hm Am -m
(4)
ΣΣ
hylh El x
(5)
Since X5 is WGN with unit variance, when
= Onm (Kronecker delta). The expectation is non-zero only
Var (Wr
Σ
h3
Waa
(6)
This sum converges because the filter is stable.
4. Normalization: The final watermark sequence We is normalized by the standard deviation:
W
We
(7)
Wi remains Gaussian with mean E[Wa] 0. Its variance is:
Var[Waa
Var[Wk]
(8)
Therefore, the marginal distribution of We is (s( 1).
K PROOF OF THEREOM 5.2 (INVARIANCE OF COHERENCY MAGNITUDE UNDER LTI FILTERING)
Proof. We have Syy(f) H XX) and Sxy(f) (f) This implies
(Cxx = (Bxx((SSv(f) (. (f)x 1.
(8x
(Heyr (1) (x)
L PROOF OF THEOREM 5.3 COOHERENCY AND SINR)
Proof. We analyze the system under the LTI assumptions stated in the theorem. The input to the dynamics H Hays is the action = μ + EW. The observed glimpse G the output of the dynamics plus sensor noise n. We aim to calculate the magnitude squared coherency between the watermark W and the glimpse G, (f
Due to the linearity of the system, the glimpse G' (in the time domain) is superposition of the responses:
G(t) (Eil ()) (Hays * p)) + n()).
(9)
We decompose G(t) into two components: G(t) S(t) Nt).
The signal component S(L) is the part derived from the watermark W:
S(1) (EH sye W)(
(10)
(t)) is the output of LTT system (defined by the combined response EH aye) with input (()..
The noise/interference component Nt)) includes the policy interference and sensor noise:
N(t) (H sys (t) 17())
(11)
24

---

Published as a conference paper ICLR 2026
By assumption, μ. 17 are mutually independent. Therefore, the input (t)) is independent of the noise component (t). Furthermore, the signal S(t) (derived only from W) is independent of (t).
We define the signal power Ps(f) and noise power (f( in the glimpse G the PSDs of (t) and (t))
respectively (Definition 5.1
Ps(J) = Sss(f) Px( = SNN
(12)
(13)
Since G = + N and and N are independent (and thus uncorrelated, assuming standard zero-mean processes for spectral analysis), the PSD of the glimpse G' is the sum of the component PSDs:
(Ja = Sss(S) + SwN(S) = Ps(J) + Px(J).
(14)
We analyze the CSD between the input W and the output G. Using the distributive property of the CSD
(derived from the linearity of expectation):
Swa(f) (w))+))(f)) Sws(f) Swx (f). Since W and N are independent (and zero-mean), their CSD zero (SwN(f) 0). Thus: Swa(f) = Sf)
(15)
(16)
The magnitude squared coherency is defined as:
|Cwo(f)1 [Swa(J)
(17)
Sww(f)Scc([)
We substitute the results from steps 2 and 3:
(Sws(112
(Cwa(f) Sww (S)Ps()) PN())
(18)
We now relate the numerator| (S) to Ps(.). Recall that S is the output of an LTI system with input W. without added noise. By Theorem 5.2 (Invariance of Coherency Magnitude under LTI Filtering), the magnitude squared coherency between W and S must be 1:
(f)((f)
[Cws(f))= Sww (f)s(f)ss(() = 1.
(19)
Therefore, we can express the numerator Eq. 18 as:
[Sws())² = Sww (f)Sss(J) = Sww Sws(J)ss
(20)
Substituting this back into Eq. 18
Sww (f(s))
[Cwa(f)R= (ww(f)(Ps())) PN(f))
(21)
Assuming the watermark has power (Sww (J) > 0), we simplify:
Ps(f)
(Cwo()))= Ps() + PN())
(22)
The SINR is defined as SINR()) expression by (f)
Palf) PN(F)
Dividing the numerator and denominator of the coherency
SINR(f) (1) SINR()) +
Ps(f)/PN(f)
(Cwa(f)
(23)
25


Reviews:
[{"review_id": "xnyIj0Y3aH", "reviewer": "Reviewer_UYqi", "summary": "The paper aims to design watermark for trained robotic policies in the observation-only setting. That is, to verify the ownership of a robot’s policy using only remote observation such as videos or motion capture. To make this concrete, the authors identifies the “Physical Observation Gap,” which captures the three key challenges. The approach focuses on Gaussian policies.\n\nThe method CoNoCo adds a covert spectral signature into the exploration noise of the policy by concentrating energy in a secret frequency band. This modification preserves the marginal distribution over actions, ensuring task performance is unaffected. The detector uses it to reconstruct and compare the signature via spectral coherency, scanning over possible execution rates.\n\nTheory shows the watermark remains statistically invisible per timestep but can be detected over time. Experiments across real and simulated environments including RoboMaster, VMAS, and MuJoCo tasks demonstrate strong detection performance, reward preservation, and some robustness to noise.", "questions": "1. Attack resilience: How does your method perform under time distortions, missing frames, or camera shifts? Any strategies to make it more invariant?\n\n2. Beyond Gaussian policies: Do you see a way to adapt this idea to deterministic or discrete-action policies while retaining reward preservation and detectability?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Well-scoped and original problem: The paper clearly frames a new challenge—verifying the ownership of a robot’s policy using only remote sensing (e.g., video), with no white-box access. The proposed “Physical Observation Gap” is realistic and well-formulated, addressing timing mismatches, unknown dynamics, and sensing limitations.\n\n2. Simple but clever method: The idea to use colored Gaussian noise with energy concentrated in a secret frequency band is elegant. It avoids changing the marginal action distribution while enabling detectability through spectral analysis. The implementation is straightforward and practical.\n\n3. Solid theoretical grounding: The paper gives intuitive and mathematically sound analysis. It shows that marginal action distributions are preserved and that the coherence metric used for detection has a direct relationship with SINR.\n\n4. Strong and diverse experiments: The authors validate the method in both simulation and a real robot setting, using various sensing modalities including motion capture and single-camera video. They report strong detection results, reasonable robustness, and include anonymity comparisons with a baseline.", "weaknesses": "1. Limited attack robustness: The experiments mainly test additive noise. But real-world attackers might apply frame drops, time shifts; none of which are evaluated here. These could undermine coherency-based detection.\n\n2. Scope is restricted to continuous Gaussian policies: There’s no discussion on how this approach might extend to discrete or deterministic policies, which are common in practice", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zFdD5RZpUI", "reviewer": "Reviewer_g3WJ", "summary": "This paper proposes Colored Noise Coherency, or CoNoCo, a watermarking strategy for robotic control policies that can be detected from remote observations. The core idea is to replace standard white exploration noise with band limited colored noise and to detect the resulting spectral signature through coherency in the frequency domain. The authors argue that coherency is invariant to unknown linear time invariant dynamics, which makes the detector robust to the physical observation gap between actions and sensed motion. The study reports strong detection from motion capture and monocular video while preserving the marginal action distribution and task reward.", "questions": "1. In the robustness to adversarial additive noise experiments in Appendix G, is the adversary given any objective to maintain performance, for example a reward preserving constraint or penalty on deviation from nominal actions?\n2. Does the detector ever raise false positives on non watermarked policies that naturally concentrate energy in the secret band due to task dynamics, and what priors or band selection rules mitigate this risk?\n3. How sensitive is detection to modest drift in the policy execution rate during a single deployment, and can the search grid adapt online?\n4. How is policy distillation or behavior cloning as a way to remove the watermarking detection capability?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- Clear problem formulation of remote watermark detection with only glimpse sequences and a careful breakdown of synchronization uncertainty, dynamics, and noise.\n- A principled detector based on spectral coherency that is motivated by standard results in signal processing and that aligns well with the physical setting.\n- Broad experimental sweep across simulated and real platforms with multiple sensing modalities, including top down and side view video, with anonymization tests and ROC based reporting.", "weaknesses": "## \n\n- Watermarks are not detected in the presence of obstacles in the navigation task. It remains to see if the CoNoCo policy characteristics would be detectable in a general cluttered environment.\n- Inability to Handle Time Offsets: This is a major operational weakness. The paper states that CoNoCo \"does not handle large time offsets well\" and that detection requires the \"glimpse data recording needs to start near the beginning of the robot's operations\". In any realistic scenario (like pulling CCTV footage), an auditor will be \"tuning in\" at an arbitrary time, not at the precise moment the robot was activated. Ideally the watermarking sequence $W_k$ would be ran in short intervals or a study of the time offset detection capabilities w.r.t. offset and detection length required would be included.\n- The authors test a naive Additive Noise Attack in Appendix G. This attack involves adding White Gaussian Noise (WGN) to the policy's actions before execution but the attacker has no other objectives like maintaining performance.\n    - An adversarial RL agent would not just add *random* noise. It could be trained with a multi-objective reward function:\n        1. Maximize the original task reward (to maintain performance).\n        2. Add random noise or change the policy in a structured way.\n    This RL agent would learn to output a structured jamming signal that would most likely interfere with the spectral signature in the secret frequency band $\\mathcal{B}$.\n    - Another option is policy distillation [1,2] where the adversary learns to copy the behavior of the watermarked policy while maintaining performance. This could effectively change the policy and thus remove the watermark.\n\n### References\n\n[1] Policy Distillation, Andrei A. R. et al., 2015\n\n[2] Refined Policy Distillation: From VLA Generalists to RL Experts, Tobias J. et al., IROS 2026", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "PSJuwPn7am", "reviewer": "Reviewer_Mmbz", "summary": "The paper presents an approach to encode IP protections into robot actions using colored noise coherency approaches. This adds noise to robot actions, preserving the marginal action distribution. The noise used is Colored Gaussian Noise (CGN), which replaces white noise used during exploration phase of the RL system training. Unlike dynamic watermarking methods for sensor inputs, this approach requires detectability and is not a strict defense against attackers - as such, it is also simple enough to be rapidly detectable. The paper proves that the CGN watermark detectability converges to unity as the 'glimpse sequence' of action data observed increases.", "questions": "1. Could the authors comment on the complexity of robots such as multi-jointed arms that have to also conduct fine manipulation? Would CoNoCo be applicable there, given the smaller margin of error for those manipulations?\n\n2. While the authors address the limitations of glimpse sequence sensor data quality requirements in the appendices, I would like to know if approaches involving signal reconstruction under noise would allow more robust watermarking without the need to fit the glimpse sequence length required to the periodicity of the signal (as mentioned in the periodicity part of open questions).", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "The paper is very theoretically sound, proving its claims in theory before moving to experimentation, in one case on real robot hardware. It is also thorough in its discussion on limitations, open questions and questions such as attack resilience of the CoNoCo approach.", "weaknesses": "For a reinforcement learning based paper that focuses on IP protections in robotics, it seems too thin on the experimental section to me, but otherwise is excellent.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "K1njNsR7a8", "reviewer": "Reviewer_RB6n", "summary": "This paper introduces CoNoCo (Colored Noise Coherency), the first framework for remotely detectable watermarking of robot control policies. Unlike prior approaches that require white-box or onboard access, CoNoCo embeds a frequency-domain signature into the stochastic exploration noise of a policy, enabling provenance verification from remote, noisy, and asynchronous observations (e.g., video footage). The watermark is injected by shaping the policy’s Gaussian noise into a narrow spectral band and later detected via spectral coherency, which is invariant to unknown system dynamics. The method is evaluated on simulated and real-world robots (e.g., RoboMaster platform) under various sensing modalities, showing high detectability, policy utility preservation, and strong robustness to additive noise attacks. The authors also open-source their full code and trained models.", "questions": "1. How does CoNoCo perform under unseen distortions such as camera compression, lighting variation, partial occlusion, or non-linear distortions that break LTI assumptions?\n\n2. Could frequency-domain regularization or multi-band embedding improve robustness to these distortions?\n\n3. Does the open-source release include pretrained detectors for other robot types or example video-based detection pipelines?\n\n4. Would combining CoNoCo with learned feature-based detectors (e.g., neural coherence estimators) further enhance robustness under non-linear observation mappings?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "The paper addresses a novel and important challenge: remote watermark detection for robotic policies, representing a new research direction beyond digital or model-based watermarking. The concept of bridging the “Physical Observation Gap” through spectral coherency is both elegant and well-motivated.\n\nThe methodology is clearly described and mathematically grounded, with supporting theorems demonstrating action-distribution preservation and LTI-invariant detectability. The experiments cover a diverse set of control environments and modalities, including real-world deployment, demonstrating consistent performance.\n\nThe paper is exceptionally well-written and organized. Figures clearly illustrate the concept and pipeline. The mathematical derivations are detailed yet readable, and limitations are candidly discussed in the appendix.\n\nThe problem addressed is highly relevant to both AI safety and IP protection in robotics. Remote verification of control policies is crucial for future large-scale autonomous deployments. The release of code and trained models enhances the paper’s impact and reproducibility.", "weaknesses": "While the paper convincingly demonstrates robustness under several noise conditions, it does not discuss or evaluate how the watermark performs under unseen or novel distortions beyond the tested scenarios. Real-world observation pipelines may involve motion blur, lighting changes, camera compression, occlusions, or domain shifts in dynamic, conditions under which the spectral coherency assumption might weaken. Without empirical evidence or analysis of these unseen distortions, it remains uncertain how broadly the robustness claim generalizes in practice.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)