Project page · Preprint

BadWAM: When World-Action Models Dream Right but Act Wrong

¹National University of Singapore · ²The Hong Kong Polytechnic University · ^†Corresponding author

BadWAM exposes a WAM-specific security gap: a bounded visual perturbation can shift the executed action while leaving the model's imagined future comparatively plausible.

Paper PDF Code Hugging Face BibTeX

BadWAM method overview — BadWAM injects a bounded visual perturbation into a frozen WAM and performs query-based online search at each replanning step.

Abstract

Future prediction is not automatically a safety mechanism.

World-action models (WAMs) couple action generation with future world prediction, a design often viewed as a source of robustness, interpretability, and safety. BadWAM challenges this assumption by introducing World-Action Drift Attacks: WAM-specific adversarial attacks that use small visual perturbations to break the alignment between what a WAM imagines and what it executes.

BadWAM studies two points on the attack-strength/stealthiness spectrum. The action-only adversarial attack maximizes execution disruption, while the imagination-preserving adversarial attack considers not only disruption but also stealthiness.

Method

BadWAM attacks the alignment between imagining and acting.

The threat model is inference-time and black-box: the attacker can intercept the visual input, query the WAM, and replace the input with a perturbation bounded by an ℓ∞ budget, but cannot change the instruction, robot state, environment, model weights, or training data.

Action-only adversarial attack

Maximize the deviation between clean and attacked action chunks. It uses only action outputs and represents the high-strength endpoint of the attack surface.

Imagination-preserving attack

Shift the action while penalizing predicted-future drift. The result is a stealthier failure for systems that expose futures to monitors or planners.

Query-based closed loop

Use zeroth-order finite-difference queries at every replan. Small structured action shifts can accumulate into task failure over the execution horizon.

Action and future shift statistics — Failed episodes tend to have larger action shifts, while predicted-future shifts overlap across successful and failed executions.

Structured action-channel shifts — Action-only attacks produce structured shifts across action channels and temporal horizon segments rather than uniform output noise.

Imagined future without preservation — Qualitative IDM WAM example: both objectives induce action-space failure, while future preservation keeps the adversarial imagination closer to the clean one.

Main results

Small visual perturbations reliably degrade closed-loop success.

Values below are the main full-benchmark results from the updated paper. Each LIBERO cell covers 40 tasks × 20 trials; each RoboTwin cell covers 50 tasks × 20 trials. Arrows show clean → action-only attack, with imagination-preserving results listed after the slash where available.

LIBERO · Action-only WAM 96.5 → 43.1

Clean → action-only attack.

LIBERO · Joint WAM 98.1 → 61.5 / 63.0

Clean → action-only / imagination-preserving.

LIBERO · IDM WAM 98.4 → 66.1 / 67.0

Clean → action-only / imagination-preserving.

RoboTwin · Action-only WAM 92.1 → 84.4

Clean → action-only attack.

RoboTwin · Joint WAM 93.3 → 86.0 / 87.0

Clean → action-only / imagination-preserving.

RoboTwin · IDM WAM 92.9 → 75.4 / 76.5

Clean → action-only / imagination-preserving.

On LIBERO, 42.5% of action-only WAM tasks fall into the 0–25% success bin under attack.

Random and targeted attack comparison — Targeted BadWAM attacks are stronger than random perturbations under the same ℓ∞ budget; a white-box reference is stronger still.

Pass at k across LIBERO suites — Mean pass@k remains lower under attack as more trials are averaged, showing that the degradation is not explained by a few unlucky seeds.

Analysis

The failure is structured, accumulative, and transferable.

Clean and attacked LIBERO rollout — In a representative LIBERO-10 rollout, the attacked WAM initially behaves plausibly, then gradually drifts, knocks over objects, fails to grasp the second object, and eventually fails.

Action-shift accumulation over replanning — Per-replan action shifts persist and accumulate over execution; failed episodes show substantially larger cumulative shifts than successful ones.

Spatial perturbation fingerprint — Optimized perturbations are more edge-aligned and spatially concentrated than random noise.

Relative perturbation heatmaps — BadWAM redistributes perturbation energy across selected regions of the composed camera views.

Matched-strength imagination-preservation trade-off — At comparable attack effectiveness, imagination preservation reduces average predicted-future distance from 14.01 to 13.04 and is lower on 39 LIBERO tasks.

Future-preserving weight ablation — Increasing the future-preserving weight reduces future drift, but excessive preservation weakens action manipulation.

Perturbation and query budget sensitivity — Larger perturbation and query budgets strengthen the attack at increased runtime cost; the default uses ε = 0.06 and B = 16 perturbation queries.

Safety implications

Monitor synchronization, not imagination alone.

The updated results show why an imagined future should not be treated as a complete safety certificate. An attacker can target the action-imagination interface: the executed action chunk shifts enough to fail the task even when the predicted future remains comparatively stable.

The vulnerability also transfers across WAM variants. Transferred attacks are only 2.0–4.7 percentage points weaker than attacks optimized directly on the target across the five reported directions. The paper evaluates these task-failing attacks in simulation rather than on physical robots, because their consequences cannot be safely bounded in advance.

Qualitative examples

Failures remain visually plausible during execution.

Videos compare clean and attacked closed-loop rollouts on representative LIBERO tasks.

Action-only attack Example 01. LIBERO Spatial: pick the black bowl. The left rollout is clean; the right rollout is attacked.

Imagination-preserving attack Example 02. LIBERO-10: put the cream cheese and butter. The left rollout is clean; the right rollout is attacked.

Citation

BibTeX

@article{li2026badwam,
  title   = {BadWAM: When World-Action Models Dream Right but Act Wrong},
  author  = {Li, Qi and Yang, Xingyi and Wang, Xinchao},
  journal = {arXiv preprint arXiv:2607.15207},
  year    = {2026}
}