BadWorld: Adversarial Attacks on World Models
Summary
BadWorld is a label-free adversarial framework that reveals structural vulnerabilities in visual world models by generating imperceptible perturbations that cause catastrophic failures in future rollouts.
View Cached Full Text
Cached at: 06/16/26, 11:33 AM
Paper page - BadWorld: Adversarial Attacks on World Models
Source: https://huggingface.co/papers/2606.16519
Abstract
BadWorld is a label-free adversarial framework that reveals structural vulnerabilities in visual world models by generating imperceptible perturbations that cause catastrophic failures in future rollouts.
Visual world models(VWMs) synthesize interactive, action-conditioned rollouts from a single context image. However, it remains an open question how robust these models are toadversarial perturbations. Standard adversarial attacks fail to assess this vulnerability because attackers lack ground-truth future videos and cannot predict subsequent user controls. We introduce BadWorld, a label-free adversarial framework tailored for autoregressive VWMs that systematically overcomes both constraints. First, to bypass the need for future supervision, we propose aself-supervised velocity attackthat directly disrupts the earlydenoising dynamicsof the model. Second, to ensure the attack generalizes across unpredictable user actions, we formulate atrajectory-adaptive bi-level optimizationthat actively mines hard control sequences to forgecontrol-agnostic perturbations. Evaluated on representative VWMs with continuous and discrete controls, BadWorld exposes severestructural fragility. Visually indistinguishable adversarial images reliably trigger catastrophic degradation infuture rollouts, leading to incomplete denoising, structural collapse, and control inconsistency. These findings reveal critical risks for deploying VWMs in safety-critical systems while highlighting a practical mechanism for privacy protection.
View arXiv pageView PDFProject pageGitHub3Add to collection
Get this paper in your agent:
hf papers read 2606\.16519
Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash
Models citing this paper0
No model linking this paper
Cite arxiv.org/abs/2606.16519 in a model README.md to link it from this page.
Datasets citing this paper0
No dataset linking this paper
Cite arxiv.org/abs/2606.16519 in a dataset README.md to link it from this page.
Spaces citing this paper0
No Space linking this paper
Cite arxiv.org/abs/2606.16519 in a Space README.md to link it from this page.
Collections including this paper0
No Collection including this paper
Add this paper to acollectionto link it from this page.
Similar Articles
BadWAM: When World-Action Models Dream Right but Act Wrong
BadWAM introduces a framework for adversarial attacks on World-Action Models (WAMs), breaking the alignment between imagination and action via small visual perturbations. The attacks significantly reduce task success rates, exposing a vulnerability in this class of models.
GameWAM: A World Action Model for Video Games
GameWAM introduces the first world-action model for native closed-loop gameplay and GUI control in video games, jointly generating visual observations and executable actions with competitive task success and revealing a source-sensitivity failure mode.
Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Models
This paper proposes DURA, a diffusion-based unrestricted robotic attack that generates visually natural adversarial patches to disrupt Vision-Language-Action (VLA) models in both white-box and black-box settings, highlighting safety risks for physically deployed robotic systems.
Baba in Wonderland: Online Self-Supervised Dynamics Discovery for Executable World Models
Introduces Alice, a closed-loop system that learns executable world models online under prior misalignment by treating failed candidate updates as structural signal, achieving improved performance on a variant of Baba Is You with semantically remapped labels.
Before the Script, Set the Stage: How Worldview Simulation Amplifies Psychologically Grounded Persuasion in Multi-Turn Jailbreaking
The paper introduces Blueprint, a safety-evaluation framework that uses WorldviewSim and Monte Carlo Tree Search to optimize multi-turn jailbreak attacks against large language models, achieving high attack success rates with few queries and revealing model-specific vulnerabilities.