BadWAM: When World-Action Models Dream Right but Act Wrong

Hugging Face Daily Papers Papers
adversarial-attacks world-action-models embodied-ai robotics safety research-paper

Summary

BadWAM introduces a framework for adversarial attacks on World-Action Models (WAMs), breaking the alignment between imagination and action via small visual perturbations. The attacks significantly reduce task success rates, exposing a vulnerability in this class of models.

World-action models (WAMs) are emerging as a promising foundation for embodied control: rather than predicting actions alone, they learn representations that couple action generation with future world prediction. This coupling is often viewed as a source of robustness, interpretability, and safety, as a robot's action can in principle be checked against its imagined future. In this paper, we show that this assumption is fragile. We introduce BadWAM, a unified framework for modeling and evaluating World-Action Drift Attacks: a new class of WAM-specific adversarial attacks that use small visual perturbations to break the alignment between what a WAM imagines and what it executes. BadWAM characterizes this attack surface along two natural criteria: attack strength and stealthiness. When the adversary prioritizes disruption, BadWAM instantiates an action-only adversarial attack, which directly drives the model toward task-failing actions. When the adversary additionally prioritizes stealth, BadWAM instantiates an imagination-preserving adversarial attack, which seeks to induce harmful action shifts while keeping the model's predicted future close to its clean imagination. Together, these two attacks capture a spectrum of WAM-specific failures: from overt action hijacking to stealthier cases where the model appears to imagine a plausible future but executes a desynchronized action. We evaluate BadWAM across different variants of WAMs. Results show that our attacks substantially reduce task success rates under closed-loop execution. For example, our action-only attack reduces the model performance from 96.5% to 43.1% success. The results of our imagination-preserving attack further exposes a WAM-specific vulnerability: moderate future-preserving regularization can maintain strong attack performance while reducing future imagination drift.
Original Article
View Cached Full Text

Cached at: 07/20/26, 09:43 AM

Paper page - BadWAM: When World-Action Models Dream Right but Act Wrong

Source: https://huggingface.co/papers/2607.15207

Abstract

World-actionmodels(WAMs)areemergingasapromisingfoundationforembodiedcontrol:ratherthanpredictingactionsalone,theylearnrepresentationsthatcoupleactiongenerationwithfutureworldprediction.Thiscouplingisoftenviewedasasourceofrobustness,interpretability,andsafety,asarobot’sactioncaninprinciplebecheckedagainstitsimaginedfuture.Inthispaper,weshowthatthisassumptionisfragile.WeintroduceBadWAM,aunifiedframeworkformodelingandevaluatingWorld-ActionDriftAttacks:anewclassofWAM-specificadversarialattacksthatusesmallvisualperturbationstobreakthealignmentbetweenwhataWAMimaginesandwhatitexecutes.BadWAMcharacterizesthisattacksurfacealongtwonaturalcriteria:attackstrengthandstealthiness.Whentheadversaryprioritizesdisruption,BadWAMinstantiatesanaction-onlyadversarialattack,whichdirectlydrivesthemodeltowardtask-failingactions.Whentheadversaryadditionallyprioritizesstealth,BadWAMinstantiatesanimagination-preservingadversarialattack,whichseekstoinduceharmfulactionshiftswhilekeepingthemodel’spredictedfutureclosetoitscleanimagination.Together,thesetwoattackscaptureaspectrumofWAM-specificfailures:fromovertactionhijackingtostealthiercaseswherethemodelappearstoimagineaplausiblefuturebutexecutesadesynchronizedaction.WeevaluateBadWAMacrossdifferentvariantsofWAMs.Resultsshowthatourattackssubstantiallyreducetasksuccessratesunderclosed-loopexecution.Forexample,ouraction-onlyattackreducesthemodelperformancefrom96.5%to43.1%success.Theresultsofourimagination-preservingattackfurtherexposesaWAM-specificvulnerability:moderatefuture-preservingregularizationcanmaintainstrongattackperformancewhilereducingfutureimaginationdrift.

View arXiv pageView PDFProject pageGitHub42Add to collection

Get this paper in your agent:

hf papers read 2607\.15207

Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash

Models citing this paper0

No model linking this paper

Cite arxiv.org/abs/2607.15207 in a model README.md to link it from this page.

Datasets citing this paper1

#### cy0307/awesome-egocentric-atlas Viewer• Updated3 days ago • 922 • 2.25k • 6

Spaces citing this paper0

No Space linking this paper

Cite arxiv.org/abs/2607.15207 in a Space README.md to link it from this page.

Collections including this paper3

Similar Articles

BadWorld: Adversarial Attacks on World Models

Hugging Face Daily Papers

BadWorld is a label-free adversarial framework that reveals structural vulnerabilities in visual world models by generating imperceptible perturbations that cause catastrophic failures in future rollouts.

World Action Models: The Next Frontier in Embodied AI

Hugging Face Daily Papers

This survey paper introduces World Action Models (WAMs), a unified framework for embodied AI that integrates predictive state modeling with action generation. It provides a taxonomy of existing methods, analyzes the data ecosystem, and outlines evaluation protocols for this emerging paradigm.

World Action Models: A Survey

Hugging Face Daily Papers

This survey provides a comprehensive overview of World Action Models (WAMs), predictive-action systems that generate future states for decision-making, and organizes existing works by their required outputs and design choices.

AHA-WAM:Asynchronous Horizon-Adaptive World-Action Modeling with Observation-Guided Context Routing

Hugging Face Daily Papers

AHA-WAM is an asynchronous world-action model that uses dual Diffusion Transformers to decouple world prediction from action execution, achieving efficient long-horizon planning and real-time control. It achieves state-of-the-art performance on robotic manipulation tasks with up to 92.8% success on RoboTwin and 78.3% on real-world tasks, while reaching 24.17 Hz closed-loop control.