Robustness to adaptive structured jamming

Investigate whether an adaptive jammer that conditions on the robot's current state and recent motion history can predict and partially cancel the coloured, keyed watermark signals used by Messaging Through Motion without access to the secret key.

Background

The paper analyzes adversaries that attempt to suppress Messaging Through Motion signals while preserving task utility. Although an adversary without the secret key cannot directly reconstruct the pseudorandom watermark, the watermark is temporally correlated because it is coloured rather than white. A jammer observing the effects of previous watermark samples may therefore become correlated with and partially predict subsequent watermark values.

The authors explicitly acknowledge that the covariance between the watermark and jammer need not vanish, so structured cancellation cannot be ruled out. Establishing whether learned, state-dependent jamming can suppress message recovery—and characterizing the associated task-performance cost—remains unresolved.

References

This does not hold. The watermark is coloured rather than white, so its samples are correlated across time, and a jammer conditioning on the current state and recent motion history observes the effects of previous watermark samples. It may therefore become correlated with, and partially predict, the current watermark without recovering the key. In general $\mathrm{Var}(W + J) = \mathrm{Var}(W) + \mathrm{Var}(J) + 2\,\mathrm{Cov}(W, J)$, and the covariance term need not vanish, so structured cancellation is not ruled out. We do not evaluate adaptive jamming.

— Remotely Detectable Keyed Communication through Motion  (2609.08920 - Chang et al., 8 Sep 2026) in Appendix, Section ‘Adversarial Robustness’, paragraph ‘Structured Jamming’