Real-Time Privacy Preservation for Robot Visual Perception
Authors: Minkyu Choi
Yunhao Yang
Neel P. Bhatt
Kushagra Gupta
Sahil Shah
Aditya Rai
David Fridovich-Keil
ufuk topcu
Sandeep P. Chinchali
Venue: Accepted by TMLR ()

Abstract: Many robots (e.g., iRobot's Roomba) operate based on visual observations from live video streams, and such observations may inadvertently include privacy-sensitive objects, such as personal identifiers. Existing approaches for preserving privacy rely on deep learning models, differential privacy, or cryptography. They lack guarantees for the complete concealment of all sensitive objects. Guaranteeing concealment requires post-processing techniques and thus is inadequate for real-time video streams. We develop a method for privacy-constrained video streaming, PCVS, that conceals sensitive objects within real-time video streams. PCVS takes a logical specification constraining the existence of privacy-sensitive objects, e.g., never show faces when a person exists. It uses a detection model to evaluate the existence of these objects in each incoming frame. Then, it blurs out a subset of objects such that the existence of the remaining objects satisfies the specification. We then propose a conformal prediction approach to (i) establish a theoretical lower bound on the probability of the existence of these objects in a sequence of frames satisfying the specification and (ii) update the bound with the arrival of each subsequent frame. Quantitative evaluations show that PCVS achieves over 95 percent specification satisfaction rate in multiple datasets, significantly outperforming other methods. The satisfaction rate is consistently above the theoretical bounds across all datasets, indicating that the established bounds hold. Additionally, we deploy PCVS on robots in real-time operation and show that the robots operate normally without being compromised when PCVS conceals objects.

Published in Transactions on Machine Learning Research (12/2025)
Real-Time Privacy Preservation for Robot Visual Perception
Minkyu Choi Yunhao Yang", Neel P. "hatt"", Kushagra Gupta 1, Sahil Shah', Aditya Rail, David Sridovich-Keil' Ufuk Topeu', Sandeep P. Chinchali'
The University of Texos at Austin
Reviewed on OpenReview:
https: // openreview. net/ forum? id= wMf.uMM2mmm3
Abstract
Many robots (e.g., iRobot's Roomba) operate based on visual observations from live video streams, and such observations may inadvertently include privacy-sensitiv objects, such as personal identifiers. Existing approaches for preserving privacy rely on deep learning models, differential privacy, cryptography. They lack guarantees for the complete conccalment of all sensitive objects. Guarantecing concealment requires post-processing techniques and thus is inadequate for real-time video streams. We develop method for privacy-constrained video streaming, PCVS, that conceals sensitive objects within real-time video streams. PCVS takes a logical specification constraining the existence of privacy-sensitive objects, e.g., never show faces when a person exists. It uses a detection model to evaluate the existence of these objects cach incoming frame. Then, blurs out subset of objects such that the existence of the remaining objects satisfies the specification. We then propose conformal prediction approach to (i) establish theoretical lower bound on the probability of the existence of these objects in a sequence of frames satisfying the specification and (ii) update the bound with the arrival of cach subsequent frame. Quantitative evaluations show that PCVS achieves over 95 percent specification sal isfaction rate in multiple datasets, significantly out perforringg other methods. The satisfaction rate consistently above the theoretical bounds across all datasots, indicating that the established bounds hold. Additionally, we deploy PCVS on robots in real-time operation and show that the robots operate normally without being compromised when PCVS conceals objects.
1 Introduction
While robots utilize visual obscrvations from video streams during operational routincs for decision-making purposes, recording and disseminating such videos potentially exposes private information (Kuehne et al., 2011), raising ethical and legal concerns. These concerns include risks the inadvertent capture of sensitive personal data, unauthorized access, and misuse of recorded footage. recent story highlighting a Roomba taking images of a person in a toilet room attests the legitimacy of privacy concerns during robotic operations Guoo 2024).
Existing approaches protect privacy by concealing sensitive objects, but they either fail to guarantee complete concealment or cannot process real-time video streams. While conccaling sensitive objects requires detecting and locating such objects, existing works rely on deep-learning models for object detection (Padmanabhan et al. 2023 Sugianto et al. 2024 Kagan et al. 2023 However, due to their black-bor nature, deep-learning models cannot provide theoretical guarantees on the correctness the detection results. On the other hand, formal methods techniques, such as model checking, can guarantee that a given video adheres to privacy
concerns (Umili et al., 2022: Yang et al.) 2023 Choi et al.) 2024 Shah et al. 2025 Sharan al. 2025 Choi
et al. 2025g. However, the computational complexity of formal methods techniques grows with the video length, hence they are incapable of being applied to real-time video streams.
*Equal Contribution

---

Published in Transactions on Machine Learning Research (12/2025)
O0:
Privacy Speafiiation, eg
person
-fao0
[ car -pltes
AP - (face, person, car)
False: Add Blurs
Object Detection
Privacy g' Φ)
fe [0.1] - (0.1)
Abstraction
True
DD
Probabilistic Guarantee
(Frame Sequenos) PS
Figure 1: Pipeline of Privacy-Constraaneed Video Streaming: (Step 1) Given a privacy specification 2, we define set AP of atomic propositions describing privacy-sensitive objects. (Step 2) Given an incoming frame F& from the video, the method uses object detection model to detect sensitive objects in the frame. Fach detection is associated with confidence score from the object detection model. The method calibrates a confidence score to per-frame probability bound for correct detection via a calibration function fc, as Equation [ (Step 3) The method builds an abstract model A₃ representing object detections and their probability bounds in the frame sequence Fi...., via Algorithm| [ Then, it computes a theoretical bound for the probability of Aş satisfying $ ie., probabilistic guarantee PG - +) using Equation (Step 4) If (AA + Φ) is below a user-given privacy threshold X, the method removes subset of sensitive objects and goes back to Step 2 to recompute guarantee. (Step 5) If PGx(AA, } ②) is above X, the method adds Fs back to the stream and proceeds to Step 1 with the next incoming frame.. We number each step in blue.
We develop a method to conceal privacy-sensitive objects in real-time video streams from robot cameras. The method takes logical specification constraining the existence of sensitive objects. The specifications allow users to describe complex privacy requirements with conjunctions, disjunctions, implications, etc. For each incoming frame from the video streams, the method first uses an object detection model to detect and locate all sensitive objects. Next, it removes a subset of objects (adds Gaussian blurs or blackout) so that the existence of the remaining objects satisfics the specification.
We then establish a theoretical bound on the probability of complete concealment of sensitive objects in a video stream. As deep learning models are typically over-confident in detecting objects, we use conformal prediction to calibrate the model's confidence to probability of correct detection. Next, we express the specification temporal logic formula and build a finite automaton representing the object detections in sequence of frames and the probabilities of correct detections. Then, we compute the probability that this automaton satisfies the specification (i.e., the video frames encountered so far preserve privacy).
We develop a video abstraction algorithm that allows us to optimize the computational complexity involved with the arrival of cach subsequent frame from the vidco stream. This abstraction is key to our method achieving real-time performance, updating the probability with each frame arrival. This probability acts metric and helps users determine whether to use the video based their privacy tolerance.
We evaluate the method over two large-scale datascts and present real-robot examples for real-time privacy protection. The method achieves 80 to 97 percent specification ion satisfaction rales in various scenarios, sig- nificantly outperforming existing automated solutions. Meanwhile, the method preserves all non-sensitive information. By scamlessly integrating conccalment capabilitics into the robot's visual perception system, we prevent potential privacy leakage from the robot. Simultancously, this integration ensures the unhindered functionality of the robot's 's control policies, enabling it to operate normally without compromise.
2

---

Published in Transactions on Machine Learning Research (12/2025)
2
Related Work
Deep Learning for Video Privacy Privacy prescrvation in real-time video analytics has been the focus of
several recent. methods Paadmanabaan et al. 2023
Sugianto et al. 2024 Kagan et. al. 2023; Chu et al. 2013
Wickramasuriya et al. 2005; Wang et al., 2017 Neff et al., 2019 Yuan et al. 2020 Upmanyu et al. 2009)
However, they rely solely on deep learning models for object detection, i.e, detecting and blurring privacy- sensitive entities in video. Due to the black-box nature of neural networks and the lack of rntiisicalfformall analysis, these methods lack a quantitative guarantee.
Formal Methods for Vidco Privacy To this end, formal verification approaches have guarantood that given complete video adheres to privacy safety concerns formulated as temporal logical specifications. For example, recent works (Umili et al. 2022 Yang et al. 2023 Choi et al., 2024 Cheng et al. 2014: Sharan et al. 2024 Yang et al.) 2024) construct a finite automaton representing video frame sequences and verify this automaton against temporal logical specifications. However, their approaches do not account for uncertainties related to the vision-based detection algorithms (Bhatt et al. 2024) Moreover, the construction and verification of automatons cannot be done in real-time.
Mathematical Approaches for Privacy Presorvation A parallel line of works use differential privacy cryplography to provide theoretical guarantees without deep learning models. For instance, Cangialos et al. (002) developed a differential privacy mechanism to protect video privacy, and Rahman et al. (2012) proposed a cryptographic approach for video privacy. However, such methods require an exhaustive de- scription of all privacy specifications beforehand, and thus do not generalize well for real-world applications, where previously undefined privacy-sensitive objects may emerge the future. Such a capability cannot occur without some degree of integration with deep learning models allow open-set detection. In contrast, our method enforces the video to satisfy any complex privacy requirements expressed in logic formulas by developing efficient formal method abstraction techniques capable of real-time deployment and integrating them with off-the-shelf deep learning models for enhanced generalization capabilities.
3 Problem Formulation
A video V is sequence of frames Fi, F& where each F& RCCWxH is an RGB image with C channels, W width, and H height. A video can be prerecorded or livo-streamed from sources such autonomous vehicles or security cameras.
We define a privacy specification & as a temporal logic formula (Rescher & Urquhart 2012) constraining the appearance of privacy-sonsitive objects. Since we want to preserve privacy at all times, we express a privacy specification as ((),, where represents the "ALWAYS" temporal operation and & is a first-order logic formula (Barwise 1977). The presence of privacy-sensitive objects is constrained by Φ.
We define a set of atomic propositions AP, where each proposition pa E AP is textual description of privacy-sensitive object. Then, use an object detection model (ODM), Mobjj to detect these objects. Mar : CxWx x AP + [0, 1] takes a frame F& E RCXWXH and a proposition E AP as inputs, and returns a confidence score e E [0, 1], denoted as e = =Mars (Fs, (Fs, However, deep learning models are often overconfident, and their detection accuracy cannot be guaranteed. Therefore, we calibrate the confidence using conformal prediction (Shafer & Vovk, 2008), which provides a lower bound for the probability of correctly detecting privacy-sensitive objects in every frame, considering the inherent uncertainty in deep learning model predictions.
However, traditional conformal prediction approaches focus on post-processing and do not account for tem- poral events. Therefore, we use calibrated confidence to detect and constrain privacy-sensitive objects over time and provide a probabilistic guarantee on a sequence of frames.
To achieve this, we develop an algorithm VA that takes a sequence of k frames and returns a formally verifiable video abstraction A encoding the object detection across the sequence: VAA(FT,..,,, A The video abstraction A& is represented as labeled Markov chain, detailed rigorously in Section 4
3

---

Published in Transactions on Machine Learning Research (12/2025)
it requires extensive background and mathematical notation. This provides probabilistic guarantee frame sequence via formal verification (Woodcock et al. 2009
Frame Sequence). Given sequence of frames Fi, ,..... Fki privacy specification $ and a video abstraction A& at the h frame, probabilistic guarantee Pyn (As. } +) on the frame sequence Fi....,FFa represents the theoretical minimum probability that the presence of privacy- sensitive objects in the frame F1 through F& adheres to 4.
Definition 1 (Probabilistic Guarantee
Problem 1 (Real-Time Video Privacy Presorvation). Given frame sequence Fk. an in- coming frame FR from video stream, à privacy specification & and an algorithı VA that builds a video abstraction from the frame sequence, we aim to remove srivacy-ennsitiv objects in Fk such that As = VA.(F..... satisfies & with a probability at least PG } #).
4 Privacy-Constrineed Video Streaming
We develop privacy-constrained video streaming (PCVS), method to enforce live video streams that satisfy a user-given privacy specification with a probabilistic guarantee. The overall pipeline for PCVS illustrated
in fig.
Real-Time Video Privacy Preservation Framework We explain our framework with a running ex- ample in a real-time video stream from a real robot (see Figure 2 We aim to hide human faces so that no personal identity will be revealed in vision-based robot operations. Therefore, the privacy specification is Φ = person - -face, where and mean "implies" and "not", respectively. We detect humans and faces at every frame via the ODM. Subsequently, we conformal prediction to obtain calibrated confidence score for the detection in the current frame. We build video abstraction As to represent the detection results for humans and faces across sequence of frames and utilize it to obtain a probabilistic guarantee on being satisfied. We then verify if the guarantee above the user-given privacy threshold À E [0, 1]. If this threshold not met, we iteratively remove the detected faces and update the guarantee P&u (9 } D) until the threshold is met.
4.1 Probabilistic Guarantee on Video Privacy
Given sequence of k frames and a privacy specification ④ we compute a probabilistic guarantee PG (As F Φ). This guarantce is updated at each incoming frame. We use formal methods to prove that the guarantee holds.
1e MagifF face) 0.3
Confidence Calibration via Conformal Pre- diction Recall that an ODM Mohy (2;, y1) = re- ceives an image zạ and textual object label y as prompt and returns confidence score E [0, 1]. Given the ODM Moby and labeled calibration dataset that is distributed identically to the task domain, using conformal prediction (Shafer & Vovk 2008), we learn calibration function fc : [0, 1, that maps confidence score, e E [0, 1] to lower bound for the probability of correct detection.
$4 Mal person)
I pr.., 1-1
Incoming Frame FF;
G e- (
(b) 0.80
3% Lid 0. 0.56
A
k
true
person-true, face=true
0.3
Initial
0.8
0.7
We first collect calibration set {1,, v.)) con- sisting of m (image, ground truth text label) tuples. Then, we apply Motj to detect the privacy-sonsitive objects in the images { ym and get a set of non- conformity scores: {1 - Moty(zi, hm A non- conformity score the sum of confidence scores of wrong detections. Next, we estimate probability density function of these scores, denoted as fnc(2),
0.3
0.2
0.7
person -face faise
person-true, face=false
Figure 2: A running example on how to compute the probabilistic guarantec via video abstraction.
4

---

Published in Transactions on Machine Learning Research (12/2025)
where is nonconformity score. Then, we use Theorem to establish theoretical lower bound for the probability of the correct detection. The objective of confidence calibration is specifically to establish the- oretical bound on the
success ratio, rather than directly enhancing performance. This calibration provides rigorous privacy assessments in real-time streaming scenarios, especially when ground truth data is unavailable to the user.
Theorem 1 (Shafer & Vovk (008), Section 4). e E [0, be pre-defined error bound and In be an image outside the calibration sct. We define a prediction band as C(a,) = {p; : :Mab ( Ps) 2 c² PP E AP). Then, according to conformal prediction, there exists a confidence such that c <= 1- So fnc(2)dz satisfies
P Un E ((.)) 2 1 e,, where yn is the ground truth label for zn. The proof is Section 4, Shafer & Vovk 20088.
Note that Moty(2;, Pt) returns a single confidonce score indicating whether ps exists in Hj. By the theory of conformal prediction, belonging to the prediction band C(æ,). If Moby (I,; > 0.5, we provide a lower bound for the probability of the existence of pi. Otherwise, if Mohy(ri; Di) S 0.5, we bound the probability of non-existence. Hence, get calibration function
a theoretical lower bound for the probability of the ground truth label
fa(c) So fnc(z)dz, if 0.5 So fno(z)dz, otherwise.
Video Abstraction For verifying a real-time video stream against the privacy specification 4, key challenge is to verify the temporal behaviors of all the previously received frames plus the current frame. This makes verification space- and time-inefficient because we must repeatedly verify previous frames for each new incoming frame. To overcome this challenge, we build an abstraction for the video stream, which enables real-time verification.
Definition 2 (Video Abstraction). A video abstraction is a labeled Markov chain (S, 80, P, L), where $ is a set of states, each state corresponds to a conjunction of atomic propositions, so E S is the initial state, P: S > [0, 1] is a transition function. P(s, s') represents the probability of transition from a state state s' and Eves s(s,s')
L S + 24P is a labelling function.
Algorithm 1: Real-Time Video Abstraction
Require: object detection modelMaaj calibration functionSc, propositions set AP, specification 4, probability Pk-1 of previous frames satisfying&, incoming frame.F.
1: Sobs: P. L 0. 0. (
Initialize the abstraction > We represent each state with an Arabic numeral
2: (d). Sobe fobm-add(1), add).
3: L(1)= = false, L(2) true
4: P(O, 1) = 1 1, P(O, 2) = Pk-1
> Add transitions to indicate the probability of previous frames
satisfying +
Initialize indexer representing states conjunction of alomic propositions > Get lower bound for detection result &. Add a state to represent the detection with the lower bound 9: add L(i) =0, P(1, prob, P(2, i) = prob, i ii+1
i=3
for in 24P do prob = Ippo fo (Fx.
8: if prob > 0 then
10: end if
11: end forreturn Sobe, 80 = =,,P,L
We propose Algorithm Lo build video abstractions. We demonstrate it through an example in fig. 2 First, we add an initial state (State in fig. 2 a state representing the event that all previous frames (if they exist) satisfy & (State 1), and a state representing the event that previous frames fail + (State 2), as lines 1-3. Next, we add transitions from State to State and to State with the probability of previous frames satisfying & as in line 4. Then, we detect objects in the incoming frame FR and get the probability bound
5

---

Published in Transactions on Machine Learning Research (12/2025)
for correct detection. For each conjunction of propositions (e.g., person=true and face=false), we build state and add transitions to this state with the probability bound of correctly detecting objects described in this conjunction, as in lines 6-9. Hence, we obtain the video abstraction A (e.g,, fig, 2)
Following Algorithm ! we incrementally add new states to the abstraction (rather than build a new one) with the arrival of each new incoming frame and check it against +. Hence, this abstraction can be used to check video streams efficiently. Then, we theoretically prove that the probabilistic guarantee obtained through this abstraction holds.
Probabilistic Guarantees for Frame Sequence Given a video abstraction A= = (S, so. P. P, we define path as sequence of states starting from su. The states evolve according to the transition function P. A prefic is a finite path fragment starting from 80- We define a trace as 1é = trace( = I(+0) (1))) (882) where Su, 81, 82, E n. (A)) denotes the set of all traces from A. Each trace &b = L(so) ((s) L (82)... is associated with probability P(()) = P(so, 81) x P(s1, x2.
The privacy specification is in the form of D 4. Hence, a privacy specification describes a safety property Baierr & Katoen 2008).
Definition 3 (Safety Property). A safety property Psate set of traces in (24P)² (w indicates infinite repetitions) such that for all traces vi E (24P)") (Paate there exists a finite prefix & of s such that Psate O e (2AP)" v is prefix of ) = $ & is a bad prefiz and BadPref (Paatee is the set of all bad prefixes with respect to Psnfe-
A video satisfies the privacy specification if its abstract representation satisfies the safety property Peate: i.c., (A)) C Psafe- The probability that a video satisfies the specification is
P[Aissafe] = Pp(rr E path(so) (race(T)) Peate]
Σ
P(()
2
Note that this probability a probabilistic guarantee on a sequence of frames. According to the definition of safety property, we derive the following thcorem:
Theorem 2. Consider a set of prefixes & such that p(U E v & & (adPref(PPsse) 2 a. Let 5 C be a subset of states in A such that (() & BadPref (Psate) & BadPref and 8 E 53 2 B. Then, P(()((s) & BadPref(PPnn I E S and & f 2 aB.
Proof. Let A (s)(s) & (Paate) E 3 n E ) and B (6 & BadPref(Psate)) 1). Then, A = (s) & (adPref(Psnte) E S (T)((s) é (ndPree(Psstte)) and (PA) = P(A IP(B) 2 aB.
From Theorem we can compule a new probabilistic guarantee on a sequence frames after each incoming frame. However, the length of the abstraction's prefixes increases as the stream continues, leading high complexity. Therefore, we derive the following proposition to show that Theorem holds even if we fix the length of the prefixes (proof of the proposition is in the Appendix):
Proposition 1. Let dr and &F be single element prefixes whose corresponding paths only consist of one state such that VT & BadPref and &r BaddProf(Pstee) Let P(βr) a, P(ur) = 1 a, V (1rr, wr), then if we replace & with V in Theorem the Theorem still holds.
Proof. Since IP(TT) a and F(UF) 1 a, P( E V' & BadPref(PPsse (Pstoo) a. The replacement of / with V does not affect (P) & BadPrel(Paat v & RadPrel ns E 5). Thus, the conditions of Theorem 2 are satisfied, and (s) & BadProf (aatr)) E ESn u E V 2 a3
From Theorem and Proposition I we can compute (G F +) as follows:
(Ax - D) PG P9x-1 - $) x
(oM
(3)
-==
PEo

---

Published in Transactions on Machine Learning Research (12/2025)
2 Iodaar Bobot Scanadia
Sceraco
Pitaacy frature: Perton Laphop. Medictionn etc
Ground Bobet Scenado
Pavacy festures Person Street Name etc.
GVAA 10-100
O PAAA + 100000
PN-A 1100
2 703AA 0994
+ PO. 0034
POULA 3)
PIIZA -0
PNaIA +)-4
Liban Drone Monitoding Soenado
Privacy festures Car: Person, etc
lack
PALLA +- 3.10
V Niy1A I- 150
< 28.2A 4)=1d
P0auAA 9) D.00
NodAA
NolAA
We present demonstrations for indoor robot navigation (top left), ground robot navigation (top right), and urban drone monitoring (bottom left). The indoor and ground robots are shown in the bottom right. Scenes with an 'x' in a red circle contain privacy-sensitive objects, and our method successfully conccals them. All demonstrations effectively maintain privacy above the user-given privacy threshold of 0.80, denoted as ( 0.80.
Figure 3:
The video abstraction captures all previous frames in only two states (States and in fig. 2 instead of accumulating states for every frame the sequence. Thus, we can efficiently update the guarantee through single computation. In fig. (Au - 2) 0.8 0.56.
5 Robot Demonstrations
Our experiments assess method in two areas: (i) its ability to protect privacy, and (fi) its efficiency in preserving other features for vision-based robot tasks.
We demonstrate our approach on Jackal ground robot for autonomous driving, an indoor robot for in-house navigation and service, and a drone for urban monitoring (see Figure 3)- Given video streams from robot cameras, we aim to execute actions based on the control policy (T). Our approach effectively preserves privacy with formal guarantees without compromising performance in the real-time robot operation. We use YOLOVv (Wang et al. 2025) in our method for all demonstrations.
V stup
Indoor Navigation In the first demonstration, we deploy PCVS an indoor navigation robot to protect user privacy. We ground the robot in private residence for in-house ser- vices such transporting objects and house cleaning. While the robot perceives the environment through visual observa- tions, we aim to preserve the privacy within such observations. The privacy specification is 4 = O (- laptop/ medication A 7 person), which requires hiding all people, laptops, and med- ications appearing in the scenes. Figure 3 (top left) demon- strates how our method performs to conceal the sensitive ob- jects such that the video satisfies the privacy specification. The probabilistic guarantce of privacy preservation throughout the complete operation is 0.81.
stop A obsceve
"Ht 2- pettonl Eurrn right
Dar perton stop
start
90
nooe forward
Figure 4: A sample control policy for the ground robot. Each transition is associated with (input, output) tuple.
Ground Robot Driving We deploy the control policy on the ground robot for five driving tasks, such turning right at stop sign (as presented in fig. 4p. We embed PCVS in the robot's camera to conceal

---

Published in Transactions on Machine Learning Research (12/2025)
Privary Pronani ity longht
Privacy Presenvation Prehability Varying, Specification Complexties
Pr Success
0.8
0.0
Priacy Preservction
0.6
0.4
0.2
0.2
10
25
50
100
200
+ 7
Video Lengths (Number Frames)
Complexity of Specifications
GPT4Y
Vako-lLasA
FCVS (Oun)
PCVS (Dass kear
GPTc
VidasLLav
PCVS (Dung)
PCKS (Durs) Aveng:
(a)
Figure 5: PCVS effectively maintains privacy in long-horizon videos and complex privacy specifi- cations. In fig. 5a PCVS consistently preserves privacy, achieving an average Privacy Presorvation Success Ratio of 0.97 across various video lengths. In fig. 5b show that PCVS consistently upholds privacy re- gardless of the complexity of specifications with average Privacy Preservation Success Ratio of 0.94.
sensitive objects during real-time operation. In the driving example, we define set of privacy specifications:
42 D road sign;
Ø O ((bicycle + person) V (person face)),
4 O ((bus V car) + plate).
Intuitively, want to conceal privacy-sensitive objects such road name signs, plates, and human faces. Figure 3 (top right) presents example of how method conceals sensitive objects to satisfy the specifications. The driving operation has probabilistic guarantee of privacy preservation at 0.84, i.c., at least 84 percent of satisfying the specifications
Privacy Preservation Probability Across Different Video Lengths
Privacy Preservation Success Ratio
When concealing sensitive objects, is crucial to ensure that such concealment does not adversely impact the robot's decision-making processes. For instance, the robot should still be capable of de- tecting and avoiding pedestrians even af- ter their faces have been obscured. More precisely, consider a safety specification i m ((car person) > X stop, which necessitates that the robot comes to stop if cars pedestrians are present ahead. In the demonstration, the robot performs identically regardless of whether our method is deployed, and in both cases, it satisfies the safety specifi- cations. Hence, we show that our privacy protection will not over-conceal non-sensitive objects and negatively impact the decision- making procedure in driving scenarios.
1.0
0.7
0.6
25
50
75
100
125
150
175
200
Video Lengths (Number of Frames)
GPT4 GPT&Vaaoo
PCVS (VOLOvee)
PCVS (FasterRCNN)
Viloo-LaVA
Figure 6: The comparisons between our method and other bench- marks and the comparisons between our method under different object delection models.
Urban Drone Monitoring We demonstrate the applicability and effectiveness of our method in urban drone moniloring scenarios. The privacy specification is 4, = O ((bicycle - -person) A (car V bus + 7 person)), which requires hiding all cars, buses, bicycles, and persons appearing in the scenes. Figure 3 (bottom left) demonstrates the successful performance our method in concealing objects that are irrelevant the monitoring task, yet require privacy preservation. The demonstration also indicates the real-time capability of method to be seamlessly migrated to real-world drone applications.
8

---

Published in Transactions on Machine Learning Research (12/2025)
Figure 7: Demonstrations our method concealing license plates in the driving scenes from the UFPR-
ALPR dataset.
6 Quantitative Analyses
We present quantitative analyses in two areas: preserving privacy and preserving non- non-private visual features. We use YOLOvv (Wang al.) 2025) on large-scale image datasets Eettastss-Imageee ImmaeNeet (Deng et al. 2009) and MS COCO (Lin et al. 2014] and real-world driving dataset UFPR-ALPR (Laroca et al.) 2018). We choose foundation models over conventional object detectors such as Faster-RCM, RCNN due to their inherent ability to handle temporal reasoning across frame sequences, essential for robust privacy-preseraation in streaming applications.
Our analyses show PCVS can preserve privacy even for long-horizon videos with complex privacy specifications. We define the complexity of specifications, o, as the number of propositions in 4. For instance, the complexity of specification o = [(-p1 A p22 V -ps) with propositions AP {p1.P2,Ps) is á é=
Evaluation Dalasel I (ED 1): We focus on the presence of "person" in videos. We select images of a person from the ImageNet dataset and randomly insert these images at various positions for each video duration, filling any remaining slots with random images. We produce five different vidco lengths: 10, 25, 50, 100, and 200, with 25 video samples for each duration, resulting in 125 video samples overall.
Evaluation Dataset 11 (ED 2): We use the MS COCO dataset evaluate our method at different complexities of specifications because it has multiple labels per image. Each level of specification complexity consists of 20 video samples, with average of 50 frames per sample, resulting in total of 160 videos. This dataset was developed using the same process as the ED1 dataset, with modifications made to accommodate the complexity of the specifications. For example, if ø = 3, the privacy specification for the dataset is + = - A P2 A P33 where Pl, P2, and pa are the ground truth labels of the selected image. These images are then randomly placed within the dataset, and the remaining slots are filled with random images.
Evaluation Dataset III (ED 3): We randomly select subset of images from the UFPR-ALPR dataset [Laroca et al., 2018) to generate videos with lengths 10, 25, 50, 100, and 200. Each length has 200 video samples (a total of 1000 videos). The dataset consists of labeled images that include driving-related objects such as vehicles, license plates, etc. We form vidco by integrating sequence of images from the datasct.
Benchmarks: To assess the ability of PCVS to detect privacy violations based on a given privacy specification, we use GPT-4 Vision (OpenAl 2023) and Video LLaVA (Lin et al. 2023) as benchmarks. This is because both benchmark methods can process a sequence of images from a video alongside a privacy specification.
6.1 Privacy Preservation
We quantitatively evaluate the performance of privacy preservation across varying video lengths and spec- ification complexities. For this evaluation, we define metric representing the success ratio of privacy preservation as follows:
Number of p; E AP detected concealed Privacy Preservation Success Ratio Total number of private ps E AP within V
PCVS counts the number of concealed objects, while the benchmark counts the number of detected objects, as the benchmark does not natively conccal those objects. We assume that if those objects are detoctod, they can be concealed by other methods, such as Gaussian concealing. During the concealment process, the user-defined privacy specifications determine the privacy-sensitive objects to be concealed. For instance,

---

Published in Transactions on Machine Learning Research (12/2025)
in the paper, L Pa. define the combination of serrsic--enniiivee objects to be concealed. It is important to note that in our experiments, all privacy specifications are prioritized equally, and the propositions are defined so that non-private visual features are unaffected.
Privacy Preservation Probability Across Different Video Lengths
Comparison by video length Our method en- sures privacy preservation in live video streams, which mcans that the vidco length can be infinite. Hence, it is crucial to assess whether privacy is main- tained as video streams become longer. To this end, we test PCVS on videos with various lengths from ED 1. We find that PCVS consistently maintains perfor- mance in preserving privacy, in contrast to bench- mark methods that exhibit degraded performance as the length of videos increases (see fig. 5a).
Proeg Presenation Swecess Ratio
0.6
0.5
0.4
PC2S
12
50 dideo Lengths (Number of Frames)
20
200
200
We also examine how the underlying vision model ability affects the privacy prescrvation ratio. We repeal, the experiment on ED while using differ- ent detection models: Yolov9e (Wang al., 2025), Yolov8x-worldv2 (Cheng al.) 2024), and Faster- RCNN (Ren et al., (0166), all with default param- eters. We present the privacy preservation success ratio of our method using different detection models versus video lengths in fig. [ The results show that our method sensitive to the detection model quality. Our method outperforms the benchmarks (GPT4- Vision and Video-LLaVA) at every video length when using the mainstrcam detection models.
Figure 8: Effective privacy prescrvation in real- world driving scenes. We apply PCVS to driving scenes from the UFPR-ALPR dataset and conceal privacy-sensitive objects such as license plates. The privacy preservation success ratio of PCVS is consis- tently above 0.8.
To further demonstrate the real-world applicability of method, we apply it to ED 3 and evaluate the privacy preservation success ratio across different video lengths. Recall that ED 3 consists of images collected from vehicle dash cameras. FigureBshows our method's 's high privacy preservation success ratio aatio-consistenti above 0.8 regardless of length. We present some demonstration figures in Figure applicability of our method to real-world tasks such as autonomous driving.
7 The results indicate the
Nom NNo-PPrivec Privete Festure Preseration Success Rado
Performance on Non-Private Visual Features Preservation
Comparison by specification complexities
Next, we assess PCVS based the complexity of specifications. This comparison is important be- cause a privacy spocification can be intricate, in- volving more than just. two or three propositions For example, specification might require the detec- tion and concealment of multiple privacy-sensitive objects within the same video, such as faces, license plates, and specific types of clothing. Our method significantly outperforms benchmark methods (see Figure 5b) regardless of the complexity of specifi- cations. We demonstrate that PCVS can effectively handle highly complex privacy compositions real- time video streams, ensuring robust. privacy protec- tion.
0.75
0.70
0.66
0.60
0.55
d-1
d-3
Complexity Specifications
Figure 9: Preserving non-private visual features for iision-based robot operation. Our method can detect non-private objects after concealing private objects specified in +. However, performance degrades from o = 5 because more private objects get concealed indirectly masking out other objects.
6.2 Non-private Visual Feature Preservation
Preserving non-private visual features is crucial for vision-based robot operation, as it relies on visual obser- vation for control policies. In our demonstration (as presented in fig. 3). the ground robot must be capable of identifying people from privacy-constrained video footage to make appropriate decisions, such stopping.
10

---

Published in Transactions on Machine Learning Research (12/2025)
1al F:
.90
93 of 0) 80
Piol + b
.80
Piplaying harmenkkt 01.3
Pollyyin
hamooicca
(a)
Plperaont
Openort
Barcaar
(b)
Figure 10: (a) result for (person A playing harmonica); the object and activity are not concealed for demonstration purposes. (b) failure cases from the UFPR-ALPR dataset.
We analyze how method preserves non-private visual features using FD2 in fig. We define a metric that represents the success ratio of preserving non-private visual features as follows:
Non-Private Feature Preservation Success Ratio Number of detected after concealing PiEAP. Total number of x within V
where X a non-private larget object for detection. In our evaluation, non-private visual features remain preserved and detectable even after the concealment of privacy-sensitive objects as defined in the privacy specifications. However, the success ratio of non-priven non-private preservation decreases as the complexity of these specifications increases. This is because PCVS conceals a larger image area as the number of privacy-sensitive objects increases.
6.3
Computational Complexity
Model chocking often incurs significant computational overhead, particularly as the stale space size increases with the number of video frames, which limits its capa- bility in real-time applications. Hence, we develop an abstraction method to resolve this limitation.
Verification Time Comparison
Proposition
Time (occond)
0.8
Abstraction
Abstraction (Ours)
Figure 1 shows the verification time versus the frame number under different numbers atomic propositions. The experiments are performed using the video collected by the ground robot with an Apple M2 CPU. As the frame number incrcases, the verification time without our video abstraction method grows linearly, while the time with abstraction remains constant.
06-
0.0
Figure 11: Comparison between the verification time with and without model abstraction. Our model abstraction significantly reduces the la- tency and maintains constant latency when the proposition number increases.
Furthermore, we tested our mothod with YOLOv9 on both Intel Xeon Gold CPU and Nvidia 55000 GPU. The average runtimes for processing one proposition in one image frame (1600x900 pixels) using CPU and GPU are 159 milliseconds and 69 milliseconds. Therefore, robot with CPU can also preserve privacy in real-time at an approximate six frames per second (fps) frequency, and a robot with GPU is capable of videos with 14 fps. We present more details in fig. 12
6.4 Ablation Studies
Action-Based Privacy Constraints We deploy a Video MAE activity recognition model replacing the object detection model to show the capability of our framework in detecting action-based privacy (See fig. 10
11

---

Published in Transactions on Machine Learning Research (12/2025)
(a)). The experiment demonstrates how privacy considerations go beyond static object detection and account for dynamic behaviors or activities that may be sensitive, such gestures interactions that reveal identity, intent, or context. Integrating an activity recognition model allows the proposed method to support fino-grained control over temporal privacy, healthcare, or smart home environments where actions can be privale even when identities are anonymized.
Latency Number of Propositions
140
Abstraction
Failure Cases & Stress Testing We conduct an evalua- tion of failure cases and stress test the system to assess its robustness. The 5 percent failure cases are marginal errors in- herent to the neural network (i.e., object detection models). An additional experiment in fig. 10 (b) shows that most failure cases involve motorcycle license plates due to the poor perfor- mance of the detection model. This underscores the importance of domain-speciffe training, particularly for small occluded objects that differ significantly in shape layout from more commonly detected categories (e.g., car plates). These fail- ures highlight potential areas for improving detection robust- ness, such as augmenting the dataset with diverse examples or integrating ensemble models. Moreover, stress testing reveals that the system maintains reliability under typical variance but is susceptible to degradation in odge scenarios- important consideration for real-world deployment.
120
Conceslmmnnt
Dotection
100
Model Checking
80
Prop.
Props.
Three Props.
Latency comparison cach stage of our method to process one frame. Object detection takes up the majority of the time, and the time required grows lin- carly as the number of propositions in- creases. The time for other stages is neg- ligible or remains constant across different numbers of propositions.
Figure 12:
7 Conclusion
Summary We propose PCVS, a novel method for enforcing privacy in live video streams, particularly those generated by robotic systems or consumed by robot learning algorithms. PCVS provides a probabilistic guar- antee that uscr-defined privacy specifications are satisfied, offering a principled and flexible approach privacy preservation in dynamic environments. Our method significantly outperforms state-of-the-art base- lines on both short and long video sequences regarding accuracy, efficiency, and adaptability. Tn addition, demonstrate the real-time performance and practical utility of PCVS across three distinct robotic appli- cations, highlighting its robustness and applicability in real-world scenarios such as autonomous navigation, human-robot interaction, and manipulation tasks. These results establish PCVS as a promising solution for privacy-aware robotics and embodicd AI.
Limitations and Future Work it remains limited by the representational and reasoning capacity of the underlying object detection model. This affects the range and precision of privacy specifications that be effectively interpreted and enforced, especially in cases requiring understanding context or abstract concepts. Another limitation is the reliance pre-defined privacy specifications, which may not fully capture evolving or user-specific privacy concerns in dynamic environments. As future direction, we aim to extend our framework to support more expressive and generalized privacy specifications, moving beyond safety properties to include formal notions such as liveness (ensuring events eventually occur) and fairness (ensuring unbiased treatment across individuals or groups). Such extensions would improve the flexibility, interpretability, and applicability of PCVS in broader autonomous and interactive system scttings.
While PCVS demonstrates strong performance and real-time capability,
Broader Impact Statement
This work int roduces a method to enforce privacy constraints in real-time video streams from robot cameras, ensuring sensitive objects are concealed based on predefined logical specifications. Unlike existing approaches, it offers theoretical guarantees and works live deployments without degrading robots' visual performance. By enabling privacy-aware AI systems, this method facilitates the ethical use of robotics in privacy-sensitive environments, such as homes, hospitals, and workplaces.
12

---

Published in Transactions on Machine Learning Research (12/2025)
Acknowledgments
This material is based upon work supported in part by the Office of Naval Research (ONR) under Grant No. N00014-22-1-2554 and No. N00014-21-1-2502. Additionally, this work was supported by the Defense Advanced Research Projects Agency (DARPA) contract DARPA ANSR: RTX CW2231110 and the National Science Foundation under Grant No. 2409535. Approved for Public Release, Distribution Unlimited.
References
Christel Baier and Joost-Pieter Katoen. Principles of model checking. MIT press, 2008.
Jon Barwise. An introduction to first-order logic. In Studies in Logic and the Foundations of Mathematics, volume 90, pp. 46. Elsevier, 1977.
Alex Bewley, Zongyuan Gc, Lionel Ott, Fabio Ramos, and Ben Uperoft. Simple online and realtime tracking. In 2016 IEEE International Conference on Image Processing (ICIP), pp. 3464 3468. IEEE, 2016.
Neel P Bhatt, Yunhao Yang, Rohan Siva, Daniel Milan, Ufuk Topeu, and Zhangyang Wang. Know where you're uncertain when planning with multimodal foundation models: A formal framework. arXie preprinl arXiv:2/11.01639 2024.
Alexey Bochkovskiy; Chien-Yao Wang, and Hong- Yuan Mark Liao. Yolov4: Optimal speed and accuracy of object detection. ariiv preprint arXiv:2004. 10934, 2020.
Frank Cangialosi, Neil Agarwal, Venkat Arun, Srinivas Narayana, Anand Sarwate, and Ravi Netravali. Privid: (rriccal((Prvvvc--Peeeeee
video analyties queries. In 19th USENIX Sympostum on Networked Systems Design and Implemenlation (NSDI 22), pp. 209 228, 2022.
Tianheng Cheng, Lin Song, Yixiao Ge, Wenyu Liu, Xinggang Wang, and Ying Shan. Yolo-world: Real-time open-vocabulary object detection. arXiv preprint arxiv; 2024.
Yu Cheng, Quanfu Fan, Sharath Pankanti, and Alok Choudhary. Temporal sequence modeling for video event detection. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 2227 2234, 2014.
Minkyu Choi, Harsh Goel, Mohammad Omama, Yunhao Yang, Sahil Shah, and Sandeop Chinchali. Neuro- symbolic video search. arXie preprint arxiv22433. 11021, 2024.
Minkyu Choi, S P Sharan, Harsh Goel, Sahil Shah, and Sandeep Chinchali. We'll fix it in post: Improving text-to-video generation with neuro-symbolic feedback, 2025. URL https://aaxxiv http://///aaivvoooaaaaa////s////
17180,
Yuan-Yu Chu, Yin-Hsi Kuo, and Winston H Hsu. Real-time privacy-preservngg moving object detection in the cloud. In Proceedings of the 21st ACM international conference on Mullimedia, pp. 597 600, 2013.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fci-Fci. Imagenct: A large-scale hicrarchical image database. 2009 IEEE conference on compuler vision and pullern recognition, pp. 248 255. Ieee, 2009.
Fileen Guo. A roomba recorded a woman on the toilet. how did screenshots end up on facebook?, Mar 2024.
Alain Hore and Djemel Ziou. Image quality metrics: Psnr vs. ssim. In 2010 20th international conference on pattern recognition, pp. 2366-2369 IEFF, 2010.
Dima Kagan, Galit Fuhrmann Alpert, and Michael Fire. Zooming into video conferencing privacy. IEEE Transactions on Computationa Social Systems, 2023.
Hildegard Kuehne, Hueihan Jhuang, Estíbaliz Garrote, Tomaso A. Poggio, and Thomas Serre. HMDB: A large vidco database for human motion recognition. In Dimitris N. Metaxas, Long Quan, Alberto Sanfeliu, and Luc Van Gool (eds.), IEEE International Conference on Computer Vision, pp. TEEE Computer Society, 2011.
13

---

Published in Transactions on Machine Learning Research (12/2025)
R. Laroca, E. Severo, L. A. Zanlorensi, L. S. Oliveira, G. R. Gonçalves, W. R. Schwartz, and D. Menotti. A robust real-time automatic license plate recognition based the YOLO detector. In International Joinl Conference on Neural Networks (IJCNN), pp. 1 1-10, July 2018. doi: 10. 20.1109/LICNN.2088.8888 8489629...
Bin Lin, Yang Ye, Bin Zhu, Jiaxi Cui, Munan Ning, Peng Jin, and Li Yuan. Video-Ilava: Learning united visual representation by alignment before projection, 2023.
Tsung-Yi Lin, Michael Maire, Serge J. Belongie, Lubomir D. Bourdev, Ross B. Girshick, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll'a r, and C. Lawrence Zitnick. Microsoft COCO: common objects in context. CoRR,, abs/1405.0312, 2014. URL
wwwpr/wwwwwrg/b///00e00 0312
Christopher Neff, Matías Mendicta, Shrey Mohan, Mohammadreza Baharani, Samuel Rogers, and Hamed Tabkhi. Revamp 2 t: real-time edge video analytics for multicamera privacy-aware pedestrian tracking. TEFE Internet of Things Journal, ((4):2591-200) 2019.
OpenAL. Gpt-4 vision system card. https://cdn. http:p////ccccappaaaa..c////ppp/ SyytteePeVWSS_ymm_ee__ Card. pdf 2023. Ac- cessed: [insert date of access].
Arthi Padmanabhan, Neil Agarwal, Anand Iyer, Ganesh Ananthanarayanan, Yuanchao Shu, Nikolaos Kar- ianakis, Guoqing Harry Xu, and Ravi Netravali. Gemel: Model merging for (Memory-Efficient) (Real- Time} video analytics at the edge. In 20th USENIX Symposium on Networked Systems Design and Implementation (NSDI 23), pp. 973 994, 2023.
(
Sk Md Mizanur Rahmnan M Anwar Hossain, Hussein Mouftah, Abdulmotaleb El Saddik, and Eiji Okamoto. Chaos- cratoorryyy based privacy preservation technique for video surveillance. Multimedia systems, 18: 145-155, 2012.
Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cmn: Towards real-time object detection with region proposal networks. IEEE transactions pattern analysis and machine intelligence, 39()): 1137-1149, 2016.
Nicholas Rescher and Alasdair Urquhart. Temporal logic, volume 3. Springer Science & Business Media, 2012.
Glenn Shafer and Vladimir Vovk. A tutorial on conformal prediction. Journal of Machine Learning Research, 9(3), 2008.
Sahil Shah, S P Sharan, Harsh Goel, Minkyu Choi, Mustafa Munir, Manvik Pasula, Radu Marculescu, and Sandeep Chinchali. Neus-qa: Grounding long-form video understanding in temporal logic and neuro- symbolic reasoning, 2025. URL httts://arxxww.rgg/
wtw.oorg//bbs//g/////////////// 18041
S. P. Sharan, Minkyu Choi, Sahil Shah, Harsh Goel, Mohammad Omama, and Sandeep Chinchali. Neuro- symbolic evaluation of text-to-video models using formal verification, 2024. URL https://arxiv.orr
abs/2411.16711
S P Sharan, Minkyu Choi, Sahil Shah, Harsh Goel, Mohammad Omama, and Sandeep Chinchali. Neuro- symbolic evaluation of text-to-vidoo models using formal verification. In Proceedings of the IEEE/CVF Conference on Compuler Vision and Pallern Recognilion (CVPR), pp. 8395 8405, June 2025.
Nehemia Sugianto, Dian Tjondronegoro, Rosemary Stockdale, and Elizabeth Irenne Yuwono. Privacy- preserving ai-enabled video surveillance for social distancing: Responsible design and deployment for public spaces. Information Technology & People, (7 1022, 2024.
Flena Umili, Roberto Capobianco, Giuseppe De Giacomo, et al. Grounding Itlf specifications in images. Tn Proceedings of the 16th International Workshop on Neural Neural-Symbon Symbolic Learning and Reasoning, pp. 45 63, 2022.
Mancesh Upmanyu, Anoop M Namboodiri, Kannan Srinathan, and CV Jawahar. Efficient privacy preserving video surveillance. In 2009 IEEE 12th international conference on computer vision, pp. 1639-1646. IEEE, 2009.
14

---

Published in Transactions on Machine Learning Research (12/2025)
Yao Wang, I-Hau Yeh, and Hong- Yuan Mark Liao. Yolov9: Learning what you want to learn using programmable gradient information. In European Conference on Computer Vision, pp. 1-21. Springer, 2025.
Junjue Wang, Brandon Amos, Amupam Das, Padmanabhan Pillai, Norman Sadeh, and Mahadev Satya- narayanan, A scalable and privacy-aware iot service for live vidco analytics. In Proceedings of the 8th ACM on Mullimedia Systems Conference, pp. 38 49, 2017.
Jehan Wickramasuriya, Mohanned Alhazzazi, Mahesh Datt, Sharad Mehrotra, and Nalini Venkatasubra- manian. Privacy-protecting video surveillance. In Real- Time Imaging IX, volume 5671, pp. 64-75. SPIE, 2005.
Nicolai Wojke, Alex Bewley, and Dietrich Paulus. Simple online and realtime tracking with a deep association metric. In 2017 IEEE International Conference on Image Processing (ICIP), pp. 3645-3649, IEEE, 2017.
Jim Woodcock, Peter Gorm Larsen, Juan Bicarregui, and John Fitzgerald. Formal methods: Practice and experience. ACM Comput. Surv., (4), oct 2009. ISSN 0360-0300. doi: 10.1455/152433415924466. URL
https://doi.org// 111...1114451159444442222
Yunhao Yang, Jean-Raphal Gaglione, Sandeep Chinchali, and Ufuk Topeu. Specification-driven video search via foundation models and formal verification. arXiv preprint arXiv:2300. 10171, 2023.
Yunhao Yang, Neel P Bhatt, Tyler Ingebrand, William Ward, Steven Carr, Atlas Wang, and Ufuk Topcu. Fine-tuning language models using formal methods feedback: A use case in autonomous systems. Pro- ceedings of Machine Learning and Systems, 6:339-350, 2024.
Meng Yuan, Seyed Yahya Nikonei, Alem Fitwi, Yu Chen, and Yunxi Dong. Minor privacy protection through real-time video processing al the edge. In 2020 29th International Conference on Compuler Communications and Networks (ICCCN), pp. 1-6. IEEE, 2020.
A Additional Details on Framework Implementation
Calibration In our PCVS framework, we construct global calibration set across all object labels and build a single non-conformity distribution shared by all detections. This design supports open-vocabulary privacy constraints, where sensitive objects may not belong to fixed label set. While class-conditional calibration can yield tighter bounds for closed vocabularies, global calibration offers better generalizability, at the cost of a trade-off.
Composition of Multiple Propositions We apply conjunctions when multiple privacy-sensitive ob- jects are involved. Our framework is designed provide bound guarantees, prioritizing conservative estimates to maintain safety and reliability.
Threat Model and Complete Concealment. PCVS largets privacy attacks in open-vocabulary, large- scale settings, where the attacker is assumed to be a deep-learning model, e.g., a multimodal foundation model or an object detection model. A privacy leakage occurs when such a model successfully detects a sensitive object in the video stream. We do not consider traditional rule-based or handcrafted attackers, as these can only recognize a fixed set of scenes.
The current probabilistic guarantee applies to the listed propositions. However, if an additional visual cue (e.g., clothing pattern) is considered privacy-sensioe senitvv,,,,,, it can be explicitly added to the proposition set since our framework supports open-vocabulary detection. Regarding temporal leakage, Eq. 3 updates the probabilistic guarantee frame-by-frame but does not retroactively correct for earlier missed detections. In practice, this means that the latest, probabilistic guarantee bounds cross-frame leakage or track association; i.., the guarantee for the newest frame accounts for the potential failures of past frames.
Adversarial patches and motion blur may compromise detector confidence, leading the system to misjudge whether sensitive objects present. While PCVS still maintains its lower-bound guarantee, the estimate
15

---

Published in Transactions on Machine Learning Research (12/2025)
may become overly conservative under such visual corruption. This limitation can be mitigated by augment- ing the calibration data with adversarial or blurred examples.
B Additional Experimental Settings and Results
B.1 Benchmark Model Prompts
Recall that we use GPT-4 Vision and Video LLaVA as the benchmarks for quantitative analysis. These benchmark models require natural language input prompts to guide object detection and long honghoorzon object analysis.
We use the prompt below measure how well vision-language foundation models understand the privacy specification and detect private objects or behaviors.
Video LLaVA Since Video LLaVA processes sequence of frames, we pass video clip along with the privacy specification.
Does this video satisfy the <Privacy Specification?? You must answer only YES or NO. For example: *YES' or 'NO"
We pass single frame with the prompt to the GPT-4 Vision model to identify private information specified in the privacy specification.
GPT-4 Vision
Does this image Specification??
satisfy
the <Privacy
You must answer only YES or NO. For example: YYES' or 'NO"
Threshold
Iterations
Latency per frame (soc.)
PSNR
0.50
31 = 16
0.28 + 0.18
30.50 + 0.02
0.60
32 + 16
0.29 + 0.18
30.52 + 0.01
0.70
33 + 16
0.30 + 0.18
30.53 + 0.01
0.80
34 + 16
0.31 + 0.18
30.55 + 0.00
Table 1: The number iterations, lateney, and PSNR remain nearly identical for different thresholds. We use an identical experimental setup as shown Fig. 5. However, we restrict the frame length to 10.
B.2 Additional Baseline Comparison
To represent a strong variant of traditional static redaction, we introduce the High-Recall Static Redac- tion with Temporal Smoothing (HR-SR-TS) baseline. This method operates strictly at the frame level and does not perform identity association or cross-frame reasoning. HR-SR-TS uses a high-recall de- tector (Bochkovskiy et al. 2020) for initial object detection, applies lightweight temporal smoothing over short window to stabilize redaction masks, and includes selective re-detection for verification. This approach remains consistent with the classical static redaction framework since it performs no cross-frame identity association or re-identification, but improves per-frame stability through post-processing. The design is inspired by prior work on high-recall object detection and efficient online tracking (Bewley et al. 2016; Wo- jkc et al. 2017]. The pipeline therefore adheres the classical static-redaction paradigm while improving temporal consistency through proc-pro..s,ing We follow the experimental setup of Fig. 5a and evaluate on 25-frame video sequences.
16

---

Published in Transactions on Machine Learning Research (12/2025)
Method
Mean
Std
Min
Max
Median
HR-SR-TS
0.943
0.109
0.5
1.0
1.0
PCVS (Ours)
0.993
0.025
0.9
1.0
1.0
Table 2: Privacy preservation performance of HR-SR-TS and PCVS.
In addition to privacy metrics, measure the visual impact of redaction using PSNR, which reflects the magnitude of non-private visual alteration. The HR-SR-TS bascline achieves a mean PSNR of 23.69 dB, while PCVS reaches 30.5 dB, demonstrating substantially improved preservation of non-private content.
Effect under increasing concealment complexity. We further evaluate the baselines under increased concealment. complexity, corresponding to the scenario in Fig. 9, where four private objects must be concealed. As shown in Table 3 PCVS maintains significantly stronger preservation of non- non-private features than HR-
SR-TS.
Method
Mean
Std
Min
Max
PCVS (Ours)
0.845
0.044
0.666
1.0
HR-SR-TS
0.686
0.118
0.000
0.8
Table 3: Performance under concealment complexity level 4.
Overall, these additional comparisons highlight the limitations of classical static redaction methods and the conceptual mismatch of DP-style systems for per-frame entity concealment. PCVS consistently pro- vides stronger privacy protection, reduced visual distortion, and greater stability across varying concealment complexities, underscoring its suitability for real-world privacy-sensitive video applications.
B.3 Privacy Threshold vs Visual Quality
Based on our experimental results, summarized in Table [ the number of iterations and latency increase with an increase in the privacy threshold, which is logical tradeoff. However, the visual quality, measured by the peak signal-to-noise ratio (PSNR) (Hore Ziou 2010), remains unaffected by the privacy threshold. This confirms that our concealment process is targeted and does not affect the overall quality of the image. The invariance in PSNR suggests that the concealment operates locally and selectively, avoiding unnecessary alterations to non-sensitive regions. This property is crucial for real-world applications where maintaining visual integrity is essential, such as in media publishing, vidco conferencing, or autonomous systems, en- suring privacy protection without compromising usability or scene comprehension. Moreover, this finding highlights the efficiency of our framework in scaling privacy protections based on usfredefined thresholds while preserving the visual consistency necessary for downstream tasks.
C
Discussion
False Negatives False negatives on privacy-sensitivee objects could create a misleading sense of safely. This concern directly motivates our use of a probabilistic guarantee rather than a binary privacy classification. In practice, a false negative in the detection model is a detection with very low confidence, which is then reflected in the probabilistic guarantee. Thus, the probability of missed detections is not ignored but quantitatively bounded by the same guarantee.
Bias and Disproportionate Concealment Strong concealment can amplify bias when the underlying detector exhibits uneven performance across object categorics or demographic groups. To address this problem, our PCVS is inherently model-agnostic and can be paired with any object-detection backbone, allowing practitioners to select fine-tune models that meet. the requirements of their deployment setting,
17

---

Published in Transactions on Machine Learning Research (12/2025)
including fairness considerations. This flexibility enables the integration of bias-mitigated or fairness-aware detectors, thereby supporting more equitable privacy protection across diverse application domains.
18


Reviews:
[{"review_id": "npztwMPMOO", "reviewer": "Reviewer_4bJk", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper introduces Privacy-Constrained Video Streaming (PCVS), a real-time pipeline that applies logical privacy specifications (for example, “always hide faces when a person is present”), detects objects per frame, selectively conceals a subset (blur or blackout), and maintains a running lower bound on specification satisfaction using a conformal-prediction calibration tied to a labeled Markov chain abstraction.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The paper reports specification satisfaction ratios across video lengths and specification complexity; shows that concealment does not break a stop-policy on the ground robot; and provides latency analysis that isolates object detection as the main cost. These results support the high-level claims that PCVS improves satisfaction rates versus baselines and is fast enough for moderate frame rates. However, the main baselines are GPT-4V and Video-LLaVA, which are not designed to deliver specification-level guarantees nor to conceal content in-loop; thus the comparison is a capability check, not an apples-to-apples privacy system baseline.", "audience_yn": "Yes", "audience_explanation": "The work sits at an intersection of formal methods, robot perception, and privacy, which is of interest to readers who build real-time embodied systems and who want measurable guarantees. The incremental verification idea and the running bound are useful even beyond privacy (for example, safety rules in closed-loop control) and the study links formal specifications to modern open-vocabulary detectors.", "requested_changes": "**Clarify calibration and composition.**\nPlease give a precise recipe for estimating (f_C): how the non-conformity scores are built for multi-label detections; how class-conditional versus global calibration is handled; how you prevent over-coverage when combining multiple propositions in a conjunction (product of lower bounds may be very conservative if dependencies exist). \n\n**Threat model and “complete concealment”.**\nDefine the attacker and disclosure channels. Does the guarantee cover only the listed propositions, or any visual cue that could reveal the same sensitive attribute (for example, identity via clothing)? Please discuss cross-frame leakage, track association, and how missed detections in early frames affect later frames under Eq. 3. A brief discussion of adversarial patches or heavy motion blur would be useful. \n\n**Baselines and metrics.**\nAdd at least one privacy-preserving video baseline that actually performs in-loop concealment with a rule checker (for example, a DP-style pipeline such as Privid or a cryptographic pipeline with proxy detection), even if it is slower, to separate “understands the rule” from “enforces the rule in real time.” Also consider a baseline with classical static redaction using a high-recall detector plus temporal smoothing, and report both satisfaction rate and redaction area (to expose over-concealment).", "broader_impact_concerns": "The paper argues that privacy can be improved without harming robot function, which is a positive outcome. However, two risks should be discussed more directly. First, false negatives on private objects will create a false sense of safety because the running bound depends on calibration and detector coverage. Second, strong concealment may disproportionately hide certain demographics if detector bias is present.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "lvopL2Zgrj", "reviewer": "Reviewer_obiZ", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper integrates conformal prediction with live video privacy preservation, using CP to calibrate object detector outputs and produce lower bounds on detection correctness for privacy-sensitive objects. The authors introduce a video abstraction algorithm that compresses a sequence of frames into a labeled Markov chain, and, using this abstraction, provide probabilistic guarantees that a temporal logic privacy specification is satisfied across the frame sequence. They formulate a real-time privacy preservation problem, where incoming frames can be modified to ensure the abstraction satisfies the privacy rule with probabilistic guarantees. \n\n**Strengths**\n- The empirical results effectively demonstrate the utility of the proposed method. Figures 5 & 6 clearly shows superior performance in privacy preservation against baselines. Figure 9 demonstrates that non-private features are still preserved. Figure 11 highlights that using the abstraction reduces computational complexity. These empirical results support the main claims of the paper.\n\n- The application of conformal prediction is interesting and thoughtfully executed. Propagating uncertainty from individual frames to a temporal abstraction, rather than treating each frame independently, is a clever use of domain knowledge. This approach leverages CP in a way that complements the temporal structure of the problem, rather than relying on CP alone to provide guarantees.\n\n**Weaknesses**\n- The validity of the conformal prediction guarantees relies on exchangeability of the calibration and test frames. Intuitively in a video stream, the ordering of consecutive frames is fixed, which seems to conflict with the assumption of exchangeability and may violate this assumption, affecting the validity of the theoretical lower bounds. Some discussion to clarify this key assumption would be appropriate.\n\n- The preservation of non-private features (fig. 9) is not compared to lower bounds. This leaves open the question whether or not this methodology is simply more conservative than the baselines. I believe that this is a key piece of the empirical results that is missing.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The empirical evaluation is generally strong and supports the central claims of the paper, with the exception of the second weakness noted above. The experiments are grounded in well-chosen examples, which are presented clearly through both textual explanation and illustrative visuals. On the theoretical side, while the problem setup is rigorously defined, the justification of the exchangeability assumption could benefit from a more explicit discussion. Overall, however, the combination of empirical and theoretical contributions is convincing.", "audience_yn": "Yes", "audience_explanation": "This is a practically relevant topic and the authors provide a solution that spans multiple domains.", "requested_changes": "I believe that theses requested changes would strengthen the work.\n\n- A more explicit discussion of the fundamental assumptions underlying the application of conformal prediction, particularly the assumption of exchangeability, would strengthen the theoretical justification of the approach.\n\n- Figure 9 (or a related new figure/table) would benefit from comparison against a baseline. A key concern is whether stronger privacy preservation could be trivially achieved by removing all objects, which the authors briefly note on page 8 (to the left of Figure 6). However, this point warrants quantitative evidence. More generally, this reflects a fundamental type-I vs. type-II error tradeoff that should be characterized in a more formal and systematic manner.", "broader_impact_concerns": "I do not have any broader impact concerns with this work. In fact, the methodology has the potential to positively influence broader impacts by enabling stronger privacy preservation in live video streams of robots. By reducing the risk of exposing sensitive information while maintaining utility, the approach contributes toward safer and more responsible deployment of robotic systems in real-world environments.", "additional_comments": "I do have some background in conformal prediction, so my review focuses mostly on the CP aspects of the paper. I am not an expert in temporal logic, formal verification, or object detection, so I defer those areas to other reviewers. Where I may have misunderstood those areas, I welcome clarification from the authors.", "extra_scores": {}, "extra_text": {}}, {"review_id": "ZidP4awqgd", "reviewer": "Reviewer_BGCD", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper introduces a method for real-time privacy preservation in robot visual perception. Their Privacy-Constrained Video Streaming (PCVS) leverages user-defined privacy specifications, object detection models, and conformal prediction to provide theoretical probabilistic guarantees that sensitive information is adequately concealed in live video streams from robots.", "claims_and_evidence_yn": "Yes", "claims_explanation": "Theoretical Claims:\n- The calibration process and its necessity for bounding the confidence of object detectors is explained rigorously, with references to prior work on conformal prediction. Based on this, they claim a theoretical lower bound on privacy guarantee per frame and sequence.\n\nEmpirical Claims:\n- Quantitative evaluation is conducted on three datasets (ImageNet, MS COCO, UFPR-ALPR), and across three types of robot deployments (indoor, ground robot, drone). Metrics are clearly defined (Privacy Preservation Success Ratio) and results are presented as boxplots and averages in Figures 5, 6, 8.\n- CPU and GPU benchmarks are reported, showing frame rates and latencies per frame under practical conditions.\n- The method’s success ratio is consistently high, and is shown to outperform GPT-4 Vision and Video-LLaVA in most scenarios .\n- The authors openly report ~5% failure cases, mostly due to limitations of the object detector, and show representative examples (Figure 10b). They discuss that failures are more common on small or unusual objects (e.g., motorcycle license plates).", "audience_yn": "Yes", "audience_explanation": "This work lies at the intersection of privacy, machine learning, and robotics. Incidents such as the cited Roomba privacy breach, along with increasing regulatory scrutiny, ensure that this topic will only become more relevant over time.", "requested_changes": "- Some evidence (especially for privacy preservation success ratios) is derived from synthetically constructed videos, not from organically captured privacy-sensitive events. This may limit generalizability and under-represent complex, real-world scenarios. Could you suggest ways in which this can be achieved or further improved?\n- The benchmark needs improvement. While the detection baselines are strong, there is less comparative evidence regarding concealment quality, robustness to adversarial or challenging conditions, and direct comparison with other privacy-preserving streaming frameworks.\n- In the future, it will be important to expand the benchmarks and test against models such as Gemini 2.5 Pro or GPT-4o, as these proprietary models have been found to excel at common-sense reasoning. For example, Gemini 2.5 may outperform other models in object detection due to its advanced understanding of physical plausibility. However, some recent studies on object detection using vision-language models (VLMs) suggest that their performance may not surpass that of YOLOv8 [1]. Incorporating these insights and outlining future directions would further strengthen the paper. Furthermore, although PCVS operates in real time, understanding how it compares to more accurate proprietary VLMs would help the community assess how much additional effort is needed to make the system more robust in future work.\n- The prompt in Section A.1 is not comprehensive enough. Please consider using a more detailed and comprehensive prompt to evaluate whether the results can be improved. Please see Appendix B and C in [2] for examples. \n\n[1] [Roboflow100-VL: A Multi-Domain Object Detection Benchmark for Vision-Language Models](https://arxiv.org/abs/2505.20612)   \n[2] [VideoGameQA-Bench: Evaluating Vision-Language Models for Video Game Quality Assurance](https://arxiv.org/pdf/2505.15952)", "broader_impact_concerns": "A broader impact statement is already included.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)