Attacking the Trusted Imagination: Oracle-Level Integrity Attacks on Imagine-then-Act World Models

Research Question and Approach

This paper investigates the security of 'imagine-then-act' robot policies, where a World-Action Model (WAM) generates a latent representation of a future trajectory to inform action selection. The authors identify a critical vulnerability: while the reactive policy might be robust, downstream 'oracles'—such as safety gates, model-predictive-control (MPC) planners, or verifiers—that rely on this imagination as a trusted prediction are highly susceptible to manipulation. The researchers employ a white-box threat model, using projected gradient descent (PGD) to apply L-infinity-bounded perturbations to camera observations, effectively steering or corrupting the latent imagination through the differentiable observation-to-imagination map.

The study reveals a fundamental asymmetry in how these models can be attacked. Untargeted corruption, which simply pushes the imagination off its natural manifold, is highly effective and significantly stronger than random noise. Conversely, targeted steering—forcing the imagination to match a specific, attacker-chosen scene—is much harder and remains bounded. The authors introduce a parameter-free denoiser-based detector that achieves an AUC of 1.0 in identifying corrupted imaginations, and they show that an adaptive attacker cannot evade this detection without sacrificing the ability to corrupt the imagination. Crucially, the authors demonstrate that while reactive policies remain robust to these perturbations, an imagination-driven MPC planner suffers significant task failure, providing the first evidence of adversary-specific task collapse in this architecture.

As robotics systems increasingly adopt generative world models for planning and safety verification, the 'trusted imagination' becomes a high-value attack surface. This research highlights that standard robustness metrics—which often focus on reactive policy success—are insufficient for evaluating the integrity of the entire system. By showing that an attacker can bypass the policy's robustness to target the downstream decision-making logic, the paper provides a necessary framework for auditing the security of complex, multi-component robotic architectures.