⚡ electrical engineering

Quantifying Trade-Offs Between Stability and Goal-Obfuscation

This paper introduces a framework for quantifying the trade-offs between stability and goal-obfuscation in safety-critical autonomy by formulating intent privacy as a joint control problem that integrates probabilistic discrete-time control barrier functions with a Rao Blackwellized particle filter observer model to simultaneously satisfy tracking requirements and information leakage constraints.

Original authors: Yixuan Wang, Dan Guralnik, Warren Dixon

Published 2026-05-08

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yixuan Wang, Dan Guralnik, Warren Dixon

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a robot trying to reach a specific destination, like a hidden treasure chest. You want to get there safely and on time. However, there is a "spy" watching you. This spy isn't trying to stop you; they are just watching your movements and using a super-smart calculator to guess where your treasure chest is.

In the world of robotics, if you move in the most efficient, straight-line way to your goal, you are essentially shouting your secret to the spy. Your path becomes so predictable that the spy's calculator quickly narrows down the possibilities until they know exactly where you are going. This is called being "legible."

This paper is about teaching the robot how to be a little bit "clumsy" or "confusing" on purpose, just enough to keep the spy guessing, without actually failing the mission.

Here is how the authors break it down:

1. The Spy's Calculator (The RBPF)

The spy uses a tool called a Rao-Blackwellized Particle Filter (RBPF). Think of this as the spy holding a bag of 1,000 different "what-if" scenarios (particles).

Some scenarios say, "The robot is going to the park."
Others say, "The robot is going to the library."
As the robot moves, the spy checks which scenarios match the robot's actual movement.
The scenarios that don't match get thrown out (or their "weight" is reduced).
Eventually, almost all the weight concentrates on just one scenario: the true goal.

The paper's goal is to stop the spy's calculator from concentrating on just one answer. They want to keep the "bag of scenarios" spread out and confused for as long as possible.

2. The Robot's Dilemma: Safety vs. Secrecy

Usually, robots are programmed to be perfectly stable. They use a mathematical rule (Lyapunov stability) that says, "Always move directly toward the goal." The problem is, this perfect stability is exactly what makes the robot easy to read.

The authors propose a new way to control the robot. Instead of just looking at the physical ground, the robot also looks at the spy's mind (the belief state). The robot asks: "If I move this way, will the spy's calculator get confused?"

3. The "Privacy Barrier"

To solve this, the authors invent a new kind of safety rule called a Probabilistic Control Barrier Function (PCBF).

Normal Safety: "Don't hit the wall."
Privacy Safety: "Don't let the spy's confidence get too high."

They treat the "spy's confidence" like a fuel tank. The robot must ensure that the fuel level (the spy's certainty) never drops below a certain line. If the tank gets too empty, the robot has failed its privacy mission.

4. The Two-Step Dance

The spy's calculator updates in two distinct steps, and the robot has to handle both:

Step A: The Observation Update (The "Listening" Phase)
The spy sees the robot move and updates their guesses. The authors found that if the robot moves toward a specific "center point" of the spy's confusion (called the Chebyshev center), it keeps the spy's guesses spread out. The robot can do this by slightly wobbling its path toward this center, rather than going straight to the goal.
Step B: The Resampling (The "Reset" Phase)
Sometimes, the spy's calculator gets so confident that it throws away all the bad guesses and only keeps the best ones. This is dangerous for privacy because it wipes out the confusion. The authors show that even when this happens, the robot can use math (specifically something called Hoeffding's inequality) to prove that the "reset" won't accidentally reveal the secret, provided the robot stays within certain boundaries.

5. The Balancing Act

The biggest challenge is that the robot has two bosses:

The Mission Boss: "Get to the goal on time and stay within this error margin."
The Privacy Boss: "Keep the spy confused."

The paper proves that you can satisfy both bosses, but only if the "error margin" (how much the robot is allowed to wobble) is wide enough.

If the robot is allowed to be very precise (a tight error margin), it has no room to wiggle to confuse the spy. The two goals fight each other, and the robot might fail.
If the robot is allowed to be a little loose (a wider error margin), it can wiggle enough to confuse the spy while still getting to the goal.

The Bottom Line

This paper doesn't just say "robots should be secret." It provides a mathematical recipe for a robot to calculate exactly how much it needs to "wobble" to keep a spy guessing, while still guaranteeing it reaches its destination. It turns the abstract idea of "privacy" into a concrete control rule that a robot can follow in real-time, ensuring that the more the robot tries to hide, the less likely the spy is to figure out the plan.

Technical Summary: Quantifying Trade-Offs Between Stability and Goal-Obfuscation

Problem Formulation
This paper addresses the challenge of maintaining intent privacy for a goal-directed autonomous agent operating in an adversarial environment. While traditional control synthesis prioritizes Lyapunov stability to ensure task completion, the authors argue that such stability inherently compromises "legibility." Specifically, the contractive dynamics of a Lyapunov basin of attraction cause a passive observer, running online Bayesian inference, to rapidly concentrate their posterior belief over the agent's latent intent parameters (goal location, radius, and arrival time).

The problem is formulated as a joint control task where the agent must simultaneously:

Track a reference trajectory to reach a goal $x^*$ by time $t^*$ within a prescribed error envelope $\varrho(t)$ .
Obfuscate its intent from an adversary modeled as a Rao–Blackwellized Particle Filter (RBPF). The adversary estimates the agent's intent $\theta^*$ using noisy position measurements.

The agent's dynamics are modeled as a fully actuated system with bounded unknown disturbances ( $\dot{x} \in u + \bar{d}\mathbb{B}$ ). The adversary's inference process is modeled as a discrete-time stochastic dynamical system evolving over the belief state space of the RBPF. The core objective is to select a control input $u$ that delays the concentration of the adversary's posterior belief (measured via Kullback-Leibler divergence) while satisfying the physical tracking constraints.

Methodology
The authors approach this as a control problem over an extended state space that includes both the physical state and the latent belief state of the observer. The methodology relies on the following components:

Information State Dynamics: The RBPF belief state $z = (\theta, \hat{x}, \omega)$ (particles, state estimates, and weights) is treated as a controlled Markov process. The agent's control input $u$ influences the belief update indirectly by shaping the observation distribution $y_k$ .
Privacy Metric: Intent privacy is quantified using a lower bound on the KL-divergence between the true intent distribution and the adversary's estimated distribution. This lower bound is derived from a weighted exponential sum of the particle kernel functions.
Probabilistic Control Barrier Functions (PCBFs): To enforce privacy, the authors define a barrier function $b(z)$ based on the information leakage lower bound. The goal is to ensure that $b(z)$ remains non-negative (or above a threshold) with high probability over a finite horizon.
Decomposition of RBPF Updates: The technical analysis decomposes the RBPF update cycle into two distinct steps, deriving separate PCBF conditions for each:
1. Bayesian Update Step: The authors derive a bound on the change in the barrier function caused by the weight update. They show that by controlling the agent's trajectory to pass near the Chebyshev center of the particle cloud, the information leakage can be bounded.
2. Resampling Step: The authors analyze the discontinuous change in the barrier function when resampling is triggered. They utilize Hoeffding's inequality to bound the contribution of reinitialized particles, demonstrating that this bound is independent of the agent's dynamics and control input.
Composite PCBF: The additive bounds from the Bayesian and resampling steps are combined using a union bound argument to form a single composite PCBF condition for the full update cycle.
Joint Feasibility Analysis: The paper investigates the interplay between the privacy constraint (maintaining high information leakage) and the tracking constraint (staying within the error envelope). This is analyzed via affine interpolation between a "privacy controller" (driving the agent toward the Chebyshev center) and a "tracking controller" (driving the agent toward the goal).

Key Contributions

Formulation of Intent Privacy as a Control Problem: The paper formulates intent privacy not as an auxiliary penalty on the physical state, but as a control problem over the latent belief dynamics induced by the RBPF. The control input is modeled as a piecewise constant signal synchronized with RBPF update times.
Finite-Horizon Privacy-in-Probability Guarantees: The authors derive a composite PCBF result that guarantees the information leakage remains above a prescribed threshold with high probability over a finite horizon. This is achieved by establishing separate probabilistic bounds for the Bayesian update and the resampling steps of the RBPF.
Independence of Resampling Bound: A notable technical finding is that the probabilistic bound for the resampling transformation is completely independent of the agent's dynamics and control input. This suggests potential for extending these results to more complex agent dynamics in future work.
Joint Feasibility Analysis: The paper provides a quantitative analysis of the trade-offs between obfuscation and tracking. It identifies inequality constraints on the interpolation parameter $\mu$ that determine whether a control input exists that satisfies both the privacy and tracking requirements simultaneously.

Results

Theoretical Guarantees: The paper proves that for any belief state within a specific sublevel set (where the initial privacy margin is sufficient), there exists a control input that satisfies the composite PCBF condition with a failure probability $\delta_f$ .
Feasibility Conditions: The analysis reveals that joint feasibility depends on the relationship between the initial privacy margin ( $\beta$ ), the bounds on information leakage increments ( $\Delta_b, \Delta_r$ ), and the tracking error envelope. Specifically, if the tracking envelope is too restrictive, the feasible set for the joint control problem may become empty, rendering obfuscation impossible while maintaining stability.
Interplay of Constraints: The results show that if the tracking error envelope $\varrho(t)$ grows sufficiently fast, the constraints on the interpolation parameter $\mu$ imposed by the tracking requirement do not conflict with the lower bounds required for privacy, allowing for a feasible solution.

Significance and Claims
The paper claims to initiate the study of intent privacy over continuous state spaces as a joint control problem involving physical and latent belief states. It posits that traditional Lyapunov-based control is inherently legible to Bayesian observers and that reducing this legibility requires intentional departure from task optimality.

The significance of the work lies in:

Providing a formal mechanism to quantify and control the "legibility" of goal-directed trajectories.
Offering a rigorous, probabilistic framework (PCBFs) to enforce privacy constraints in real-time control synthesis.
Highlighting the fundamental tension between stability (convergence to a goal) and privacy (maintaining ambiguity), and providing the mathematical tools to analyze the feasibility of satisfying both.

The authors remain modest regarding the scope of their results, noting that further study is required to establish convergence properties of the RBPF and to determine the conditions under which obfuscation becomes infeasible if strict tracking stability is enforced. They also note that numerical and hardware experiments are necessary for validation, which are not included in this theoretical work.