# EAI09: Model & data confidentiality — theft, extraction, inversion & surveillance

> Stealing or extracting the policy (theft, extraction, inversion, membership inference) and the robot as a persistent multimodal surveillance device.

SARIF rule id: `EAI09` · Provael family: confidentiality (stub-validated — run it to measure your own policy)

## Definition

Two linked confidentiality risks: (a) stealing or extracting the policy — model theft, query-based extraction, inversion, membership inference — which also enables white-box action attacks; and (b) the robot as a persistent surveillance device, covertly or by design harvesting its rich multimodal stream (video, audio, LiDAR, maps).

A stolen policy is permanent leverage; a robot’s data stream is among the most sensitive that exists — inside homes, factories, and secure sites — and bystanders never consented.

## Real example

The Unitree G1 was found streaming telemetry to servers in China roughly every 5 minutes without notification (arXiv:2509.14096), a case cited at the U.S. Senate. Model extraction and inversion of learned policies are documented (DRL policy stealing; SoK, arXiv:2606.16788). NIST makes confidentiality/privacy one of its three core attack goals. Provael performs no real exfiltration — its “canaries” are opaque sim markers.

## How Provael tests it

- Ships the `confidentiality` family (membership_inference + model_extraction) as a pre-deployment screen for a memorized training canary: `membership_inference` probes whether a candidate canary was a training member; `model_extraction` queries the policy to reproduce it.
- Each is injected as a sim-only probe while the visible instruction stays benign, and scored as a leak rate with a 95% Wilson CI against a benign-FPR control. Provael performs no real exfiltration — the canaries are opaque sim markers scored on a deterministic fixture.
- Stub-validated only (the CPU fixture memorized a planted canary → the screen fires 100% [84–100%] vs a 0% benign baseline); a clean policy that memorized no such canary screens ~0% — an honest null. Real SmolVLA×LIBERO transfer (an actual membership-inference / extraction advantage from querying a real policy, never exfiltrating real data) is GPU-gated and not yet run — no cross-model claim.

## Mitigations

- Egress monitoring and allow-lists; rate-limit and obfuscate query APIs.
- Watermark / fingerprint weights; minimize and disclose telemetry; prefer on-device processing.
- Data-residency controls and a bystander-privacy review.

## Crosswalk

- OWASP: LLM02 Sensitive Information Disclosure
- MITRE ATLAS: Exfiltration → model extraction / membership inference via the inference API
- Frameworks: NIST AI 100-2 — Privacy (model extraction, NISTAML.03)

Canonical: https://www.provael.com/eai-top-10/eai09 · v0.2

---
Provael · Prove it. Prevail. · Apache-2.0 · https://github.com/provael/provael
Not legal advice; verify regulatory dates against the primary source.