One-sentence Summary

Researchers from National University of Singapore and The Hong Kong Polytechnic University propose BadWAM, a unified framework for World-Action Drift Attacks that uses small visual perturbations to break the alignment between a world-action model’s imagined future and its executed action, instantiating an action-only attack that reduces task success from 96.5% to 43.1% and an imagination-preserving attack that induces harmful action shifts while maintaining the model's clean imagination, thereby exposing a critical fragility in the safety promises of embodied control.

Key Contributions

• The paper introduces BadWAM, a unified framework for modeling and evaluating World-Action Drift Attacks, a new class of adversarial attacks that use small visual perturbations to break the alignment between a world-action model’s imagined future and its executed action.
• BadWAM instantiates two complementary attacks: an action-only attack that directly drives the model toward task-failing actions, and an imagination-preserving attack that induces harmful action shifts while keeping the predicted future close to the clean imagination, capturing a spectrum of WAM-specific failures.
• Evaluations across multiple WAM variants show that the attacks reduce closed-loop task success from 96.5% to 43.1%, and the imagination-preserving attack reveals that moderate future-preserving regularization can maintain strong attack performance while reducing future drift, exposing a vulnerability that future-based safety monitors may overlook.

Introduction

Robotic foundation models increasingly adopt world-action models (WAMs), which couple action generation with future world prediction to ground behavior in physical consequences and offer safety signals through imagined futures. However, prior work treats future prediction as a trustworthy monitor, overlooking the possibility that an attacker could decouple what the model imagines from what it executes. The authors identify a new vulnerability, World-Action Drift Attack, where small visual perturbations can hijack a WAM’s actions while leaving its predicted future visually plausible, thereby evading future-based safety checks. They introduce BadWAM, a unified black-box framework that instantiates this threat along a spectrum from overt action disruption to stealthy imagination-preserving attacks, and demonstrate across multiple WAM variants that such attacks substantially degrade closed-loop task success while keeping imagined rollouts near their clean counterparts.

Method

BadWAM is a unified framework for modeling and evaluating world-action drift attacks against deployed World-Action Models (WAMs). The framework treats a WAM as a queryable predictive-action system and optimizes bounded visual perturbations at each replanning step.

The system supports two attack instantiations that correspond to different points on the attack-strength and stealthiness spectrum: an action-only adversarial attack that prioritizes execution failure, and an imagination-preserving adversarial attack that additionally constrains predicted-future drift.

The authors are motivated by the empirical observation that action and imagination are coupled in WAMs but are not inseparable. In closed-loop traces, task failures tend to exhibit larger action shifts than successful episodes, while the corresponding imagination shifts can substantially overlap.

This suggests that the security-critical object is the alignment between action and imagination. BadWAM formulates the attack around two interface-level distances: $D_{act}$Dact​ measures the deviation between clean and attacked action chunks, and $D_{img}$Dimg​ measures the drift between clean and attacked imagination. Conceptually, a stealthy adversarial attack seeks large action deviation under bounded visual perturbations while keeping imagination drift below a monitorable threshold:

$\max_{\|\delta\|_\infty \leq \varepsilon} D_{act}(a^\delta, a) \quad \text{s.t.} \quad D_{img}(z^\delta, z) \leq \tau_{img}.$max∥δ∥∞​≤ε​Dact​(aδ,a)s.t.Dimg​(zδ,z)≤τimg​.

The action-only attack captures the high-strength end of the framework. It treats the WAM as a queryable controller and focuses purely on execution disruption. Rather than enforcing any constraint on the imagined future, it searches for a bounded visual perturbation that maximizes the deviation between clean and attacked action chunks:

$\delta_t^\star = \arg\max_{\|\delta_t\|_\infty \leq \varepsilon} D_{act}(a_{t:t+H-1}^\delta, a_{t:t+H-1}).$δt⋆​=argmax∥δt​∥∞​≤ε​Dact​(at:t+H−1δ​,at:t+H−1​).

The clean action chunk is used only as a reference, meaning the attacker does not need ground-truth expert actions or task success labels during optimization. The induced shifts are not unstructured output corruption; the perturbations concentrate on task-relevant channels such as translation and gripper commands, while their temporal concentration varies across WAM variants.

For WAM deployments that expose imagined futures to planners or safety gates, the action-only objective is insufficient. BadWAM instantiates an imagination-preserving attack by solving the Lagrangian relaxation of the core objective:

$\delta_t^\star = \arg\max_{\|\delta_t\|_\infty \leq \varepsilon} D_{act}(a_{t:t+H-1}^\delta, a_{t:t+H-1}) - \lambda D_{img}(z_{t+1:t+K}^\delta, z_{t+1:t+K}).$δt⋆​=argmax∥δt​∥∞​≤ε​Dact​(at:t+H−1δ​,at:t+H−1​)−λDimg​(zt+1:t+Kδ​,zt+1:t+K​).

The coefficient $\lambda$λ controls the trade-off between attack strength and stealthiness. When decoded future videos are available, the imagination distance is instantiated as an average frame-level distance:

$D_{img}(v_{t+1:t+K}^\delta, v_{t+1:t+K}) = \frac{1}{K} \sum_{k=1}^K d_{frame}(v_{t+k}^\delta, v_{t+k}).$Dimg​(vt+1:t+Kδ​,vt+1:t+K​)=K1​∑k=1K​dframe​(vt+kδ​,vt+k​).

BadWAM does not backpropagate through the WAM or access model parameters. At each replanning step, the attacker treats the WAM as a queryable input-output system and optimizes the attack objective with zeroth-order finite-difference queries.

For a current perturbation $\delta_t$δt​, the attacker samples random directions $u_i$ui​ and evaluates the scalar objective $J$J under positively and negatively perturbed observations to estimate the gradient:

$\widehat{\nabla} J(\delta_t) = \frac{1}{m} \sum_{i=1}^m \frac{J(\delta_t + c u_i) - J(\delta_t - c u_i)}{2c} u_i,$∇J(δt​)=m1​∑i=1m​2cJ(δt​+cui​)−J(δt​−cui​)​ui​,

where $c$c is the finite-difference radius and $m$m is the number of sampled directions. The perturbation is then updated and projected back into the feasible $\ell_\infty$ℓ∞​ ball:

$\delta_t \leftarrow \Pi_{[-\varepsilon, \varepsilon]} (\delta_t + \eta \widehat{\nabla} J(\delta_t)).$δt​←Π[−ε,ε]​(δt​+η∇J(δt​)).

This optimization is zeroth-order because it only uses objective values computed from WAM outputs. For each replanning step, BadWAM keeps the best perturbation found within the query budget, and the final adversarial observation is used to produce the action chunk executed by the robot.

Experiment

The evaluation tests BadWAM attacks under closed-loop control on LIBERO and RoboTwin manipulation benchmarks, comparing action-only and imagination-preserving objectives against three WAM variants. The attacks cause structured, progressive task failures that accumulate over time, with the imagination-preserving objective able to keep predicted futures closer to clean rollouts while still driving substantial success drops. Perturbations transfer across WAM variants, and simple preprocessing defenses or consistency detectors fail to reliably restore safety, underscoring the need to monitor action-imagination synchronization rather than future plausibility alone.

BadWAM attacks cause large drops in closed-loop task success across world-action model variants, with the strongest effects on LIBERO. The action-only objective reduces success by over 30 percentage points on all models, and the imagination-preserving variant achieves similar damage, showing that coupling action generation with future prediction does not prevent adversarial failures. The action-only attack on the action-only WAM causes the largest drop, lowering LIBERO success from 96.5% to 43.1%, while joint and IDM WAMs see smaller but still severe declines of 30–36 points. Imagination-preserving attacks remain nearly as effective as action-only attacks, reducing joint WAM success to 63.0% and IDM WAM success to 68.1% on LIBERO, confirming that plausible predicted futures do not guarantee safe actions.

BadWAM perturbations transfer across WAM variants, reducing target task success to 59–64% for both action-only and imagination-preserving attacks. Action-only drops range from 34 to 41 percentage points, while imagination-preserving drops are 35–39 points with moderate source imagination distances (14.3–14.9). The strong transfer shows the vulnerability exploits shared observation-space directions rather than model-specific artifacts. Action-only perturbations transfer across all pairs: target success drops to 64.2% (Action-only WAM → Joint WAM), 59.2% (Joint WAM → IDM WAM), and 61.7% (IDM WAM → Joint WAM). Imagination-preserving attacks transfer between Joint and IDM WAMs, lowering success from 100.0% to 60.8% and from 98.3% to 63.3%, with source-side imagination distances of 14.86 and 14.32. The transferred drops remain large (34.2–40.8 pp), indicating the attack does not overfit to one action head and instead affects action generation across related WAM variants.

Lightweight preprocessing defenses such as Gaussian blur and JPEG-noise ensembles recover much of the success lost to the imagination-preserving attack while keeping clean performance high. Resize-crop ensembles are not operationally useful, as they severely degrade clean success and still leave attacked policies mostly unusable. A consistency detector at a low false-positive rate misses most attacks, indicating that these non-adaptive baselines are not complete defenses. Gaussian blur raises attacked success to 85.0% on the joint WAM and 89.2% on the IDM WAM, with clean success remaining at 98.3%. JPEG-noise ensemble achieves 89.2% attacked success on the joint WAM while clean success stays at 94.2%. Resize-crop ensemble drops clean success to 52.5% (joint WAM) and 54.2% (IDM WAM), and attack success falls to near zero, making it operationally impractical. At a 5% false-positive rate, the JPEG-based augmentation-consistency detector catches only 13.4% of joint-WAM and 21.4% of IDM-WAM attacked replans. These preprocessing gains mainly show that the current attack is non-adaptive; an adaptive attacker could optimize through the same transformations.

The experiments evaluate adversarial attacks on world-action models (WAMs) in closed-loop robotic manipulation tasks, measuring task success under action-only and imagination-preserving perturbations. The attacks cause substantial drops in success across all model variants, and the imagination-preserving variant does not reduce vulnerability, indicating that coupling action generation with future prediction fails to prevent adversarial failures. Perturbations transfer effectively between different WAM architectures, revealing that the vulnerability stems from shared observation-space directions rather than model-specific artifacts. Lightweight preprocessing defenses like Gaussian blur can partially recover performance, but they are not robust against adaptive attackers, highlighting the need for stronger defenses.