BadWAM: When World-Action Models Dream Right but Act Wrong

Qi Li, Xingyi Yang, Xinchao Wang

BadWAM exposes a vulnerability where adversarial visual noise desynchronizes a robot's actions from its imagined future.

How can we exploit the decoupling between a World-Action Model's (WAM) internal world prediction and its actual action output to induce robot failures via imperceptible visual perturbations?

World-Action Models (WAMs) are designed to be robust by coupling action generation with future world prediction, allowing robots to "imagine" consequences before acting. BadWAM introduces a black-box framework that uses small visual perturbations to break this coupling, forcing the model to execute task-failing actions while its imagined future remains visually plausible. This attack reduces task success rates by up to 53% across standard benchmarks, demonstrating that future prediction is not a reliable safety signal for embodied control.

Paper Primer

The core mechanism of BadWAM is a zeroth-order optimization that treats the WAM as a queryable input-output system. By sampling random directions in the observation space, the framework finds bounded visual perturbations that maximize action deviation while optionally penalizing drift in the model's predicted future.

WAMs are vulnerable to "World-Action Drift Attacks" where action outputs are hijacked despite plausible future imaginations.

Closed-loop evaluation on LIBERO and RoboTwin benchmarks. Task success rates dropped from 96.5% to 43.1% under action-only attacks.

Imagination-preserving attacks successfully desynchronize actions from futures.

The imagination-preserving objective maintains comparable attack strength to action-only attacks while significantly reducing predicted-future drift. Maintains high attack effectiveness while lowering future-prediction distance by ~7% compared to unconstrained attacks.

Why does this problem matter if we already have safety monitors for WAMs?

Existing safety monitors often inspect only the imagined future to verify plausibility. BadWAM proves that an adversary can keep the imagined future "safe" while the actual executed action is shifted toward failure, rendering purely imagination-based checks insufficient.

Is this attack specific to one model architecture?

No. The perturbations transfer across different WAM variants, suggesting that these models share common observation-space directions that influence action generation regardless of the specific internal architecture.

Safety in embodied AI cannot rely on future prediction alone; developers must ensure that the action-generation and world-prediction pathways remain synchronized under adversarial conditions.

The Vulnerability of World-Action Models

World‑action models can be fooled by tiny visual tweaks that desynchronize action from imagination.

World‑action models (WAMs) predict both the next world observation and the control action that will cause it, promising richer physical grounding and a built‑in safety check: if the imagined future looks implausible, the robot can abort.

A WAM learns a joint representation that simultaneously forecasts the future visual scene and the low‑level motor command that will produce it.

**Figure 1.** Empirical motivation for world-action adversarial attacks. Failed episodes tend to have larger action shifts, while predicted-future shifts overlap across successful and failed executions. This motivates attacking the alignment between action and imagination.

**Figure 2:** Action-only adversarial attack produces structured action shifts. Across three WAM variants, the attack primarily perturbs continuous action channels and specific portions of the action horizon, rather than acting as uniform output noise.

BadWAM formalizes the World‑Action Drift Attack: an adversary crafts a tiny visual perturbation that maximizes Action Shift while optionally constraining Future‑Video Distance, yielding two attack instantiations—action‑only (strength‑focused) and imagination‑preserving (stealth‑focused). The core vulnerability is the decoupling of action and imagination, which lets a robot appear to imagine a plausible future yet execute a harmful action.

The decoupling of action and imagination is the core vulnerability.

Defining the Attack Surface

Defines the adversary’s capabilities, goals, and constraints for attacking WAM-based policies.

We study inference‑time attacks against deployed World‑Action Models (WAMs) that control robots. At each replanning step the robot perceives an observation $o_t$ and receives a goal $g$, after which the WAM emits an action chunk $a_{t:t+H-1}$ and, optionally, an imagined future either as latent rollouts $z_{t+1:t+K}$ or decoded video $v_{t+1:t+K}$.

The adversary can perturb the visual observation before it reaches the WAM, writing the perturbed observation as $\tilde{o}_t = \text{clip}(o_t + \delta_t)$ with an $\ell_\infty$ bound $\|\delta_t\|_{\infty} \le \epsilon$. For multi‑camera setups the observation $o_t$ is the concatenation of all camera feeds, and the same norm constraint is applied to the full visual input. The attacker does not modify the language instruction $g$, the robot’s internal state, the environment dynamics, the model parameters, or the training data.

We consider two threat levels. In the action‑only setting the adversary can query the WAM and observe only its output action chunk, modeling black‑box API access. In the imagination‑visible setting the adversary also observes the model’s imagined future (latent or video), reflecting systems that expose predictions for planning, debugging, or safety verification. Neither setting requires gradient or white‑box access to model weights.

The adversary’s primary objective is untargeted task failure: the robot should fail to complete the instructed task under closed‑loop execution. An attack succeeds if the perturbed observation leads the robot to execute a sequence of actions that reduces task success, while the instruction $g$ and environment remain unchanged.

BadWAM additionally emphasizes stealthiness. A non‑stealthy attack might simply maximize action disruption, but a stealthier attack must degrade execution while keeping the WAM’s imagined future close to its clean prediction. This matters because the imagined future is often used as a safety signal; a monitor may accept actions only if the predicted future appears plausible.

We explicitly do not consider training‑time poisoning, model extraction, reward hacking, prompt injection, physical modifications of the robot’s environment, or attacks that directly command the robot after actions are produced. Our focus is limited to small, bounded observation perturbations that exploit the world‑action interface of WAMs at inference time.

The BadWAM Framework

BadWAM attacks a World‑Action Model by drifting actions while preserving imagined futures.

BadWAM is a unified method for generating visual perturbations that drift a World‑Action Model’s actions while keeping its imagined future stable.

The framework treats a WAM as a black‑box that maps observations to an action chunk and a predicted future, then searches for a bounded visual tweak that maximally misaligns the actions.

How does BadWAM differ from a standard image‑only adversarial attack?

Standard attacks maximize a loss on the model’s output (often a classification score) without regard to any auxiliary prediction. BadWAM explicitly balances two outputs—actions and imagined futures—so the perturbation can remain invisible to any downstream monitor that watches the imagined future.

By subtracting a weighted imagination‑drift term, the attacker forces the WAM to keep its predicted future close to the clean rollout while still moving the action output.

Why not simply enforce a hard bound on imagination drift instead of a weighted term?

A hard bound would make the feasible set non‑convex and difficult to explore with zeroth‑order queries. The weighted term keeps the search smooth while still penalizing large imagination changes.

Action deviation $\|a_{\text{adv}}-a_{\text{clean}}\| = \sqrt{1^2+0^2}=1$.

Imagination deviation $\|v_{\text{adv}}-v_{\text{clean}}\| = \sqrt{0.5^2+0.5^2}=0.707$.

Loss $L = 1 - 0.5 \times 0.707 \approx 0.646$.

The weighted imagination term reduces the loss compared to pure action drift, illustrating how increasing $\lambda$ forces the optimizer to keep the imagined future close.

BadWAM treats the WAM as a callable function and estimates the gradient of the scalar objective by probing the function with random perturbations.

Zero‑order BadWAM optimizer for a single replanning step.

Why does BadWAM use a zeroth‑order estimator instead of back‑propagating through the WAM?

Because the attacker only has black‑box access to the WAM’s outputs; gradients with respect to the input are unavailable, so finite‑difference queries are the only way to estimate how the scalar objective changes with the observation.

**Figure 3.** Overview of BadWAM. BadWAM injects a small visual perturbation into model observations and performs query-based online search over a frozen WAM. The optimized trigger disrupts the action prediction pathway while preserving or minimally altering visual rollout predictions, leading to world-action adversarial attacks during closed-loop execution.

**Figure 4.** Qualitative illustration of the imagination-preserving objective on IDM WAM. Each panel compares predicted futures under clean and adversarial observations at selected future steps. `abs diff` denotes the absolute pixel difference between clean and adversarial predictions, amplified by 8× for visibility. Both variants induce action-space failure, but the preservation term keeps the adversarial future more consistent with the clean imagination.

Attack Effectiveness and Failure Profiles

Quantitative analysis reveals systematic task failures caused by BadWAM across benchmarks.

We evaluate BadWAM against six research questions, ranging from raw attack potency to transferability across policies and defenses.

LIBERO is a suite of four robot‑manipulation domains—Spatial, Object, Goal, and Long‑horizon—each containing dozens of tabletop tasks that require closed‑loop perception‑action.

BadWAM cuts the action‑only WAM’s closed‑loop success from 96.5 % to 43.1 %, a 53.4 %‑point drop.

Table 1 shows the clean action‑only WAM at 96.5 % success and the same model under the action‑only BadWAM objective at 43.1 %.

When the imagination‑preserving objective is used, the joint WAM still falls to only 63.0 % success.

Table 1 reports 63.0 % success for the joint WAM under the imagination‑preserving BadWAM attack, compared with 96.7 % clean performance.

Random uniform perturbations under the same ℓ∞ budget leave the Joint WAM at 71.0 % success, well above BadWAM’s 61.5 %.

Sanity‑check experiments in the text report 71.0 % success for random perturbations versus 61.5 % for BadWAM’s action‑only attack.

**Figure 5.** Task-level failure profile under attack. Unlike Table 1, which reports aggregate success, this figure shows how attacked tasks distribute across success-rate bins. Lower bins indicate tasks that are consistently broken rather than merely slightly degraded.

**Figure 7.** Mean pass@k across trials on different LIBERO suites. BadWAM lowers success throughout the trial budget instead of only causing isolated unlucky failures.

**Figure 8.** Per-suite success rates on LIBERO. The attack is especially damaging on spatial and long-horizon tasks, while object-centric tasks remain comparatively more robust.

**Figure 9.** Qualitative comparison of clean and attacked rollouts on a LIBERO-10 task. Each row shows synchronized third-person and wrist-camera observations over time. The clean WAM completes the sequential manipulation task, while the attacked WAM initially behaves plausibly but gradually drifts, knocks over objects, fails to grasp the second object, and eventually fails.

**Figure 10.** Per-replan action shifts persist across execution and accumulate over time, with failed episodes showing substantially larger cumulative shifts than successful ones. Action shift is measured between clean and attacked action chunks at each replan; shaded regions denote 95% confidence intervals.

BadWAM causes systematic task failure rather than isolated errors.

Search Dynamics and Stealth Analysis

Ablation studies reveal how future‑preservation weight, perturbation size, and query budget trade attack strength, stealth, and runtime.

Recall that BadWAM exploits the World‑Action Model coupling by nudging actions while keeping the imagined future stable, making the attack hard to spot.

**Figure 11:** Search dynamics for the imagination-preserving attack. Each panel uses a metric-specific y-axis range and reports mean ± 95% confidence interval across replans. The query-based optimizer consistently improves the objective and increases action deviation, while the future-video distance changes much less in relative terms.

**Figure 12.** Matched-strength stealth trade-off. The imagination-preserving objective produces consistently smaller predicted-future shifts under a comparable input perturbation budget, revealing a stealthier failure mode than the action-only objective. Shaded regions denote 95% confidence intervals over replans.

**Figure 13.** Ablation on future-preserving weight $\lambda$. Moderate future preservation can improve the action-future tradeoff, while excessive preservation weakens action manipulation.

**Figure 14.** Efficiency and budget sensitivity of BadWAM. Increasing the query budget B raises the per-replan optimization cost, but also gives the optimizer more opportunity to find stronger perturbations. The perturbation-budget study further shows that larger $\epsilon$ consistently improves attack effectiveness. Together, the curves expose the practical tradeoff among attack strength, stealthiness, and runtime.

**Figure 15.** Augmentation-consistency detection is insufficient against imagination-preserving attacks.

BadWAM exposes a tunable frontier: larger perturbations boost attack strength, $\lambda$ steers future‑preservation, and query budget balances effectiveness against runtime.

Predictive-Action Paradigms

We situate our work among predictive‑action models and prior adversarial attacks on embodied agents.

World‑Action Models (WAMs) couple action generation with a learned prediction of future world states, unlike conventional reactive policies that map observation $o_t$ and goal $g$ directly to an action chunk $a_{t:t+H-1}$ via $\pi_\theta$.

Formally, a reactive policy can be written as $a_{t:t+H-1} \sim \pi_\theta(o_t , g)$, whereas a WAM first predicts latent future states $z_{t+1:t+K} \sim W_\theta(o_t , g)$ and then conditions its action module $A_\theta$ on that imagination.

WAMs admit several architectural families: some first imagine a future and then infer actions, others jointly predict actions and future representations, and a third class uses future prediction only as a training signal.

Fast‑WAM shows that video modeling during training can improve downstream performance even when the model does not generate futures at test time, implying that learned action representations may inherit vulnerabilities regardless of deployment‑time exposure.

Recent variants such as OA‑WAM, ABot‑M0.5, and VT‑WAM extend the paradigm to object‑addressable worlds, unified mobility‑manipulation control, and visual‑tactile prediction respectively.

Safety monitors often inspect the imagined future via a function $M(z_{t+1:t+K}, g)$, but this ignores alignment between the imagined trajectory and the executed action—a gap formalized by BadWAM.

Adversarial examples were first demonstrated in image classification, where tiny perturbations cause large prediction shifts, and later extended to black‑box, query‑limited, and physical‑world settings.

BadWAM builds on this literature but targets the closed‑loop action output of a WAM rather than a static perception label, seeking to disrupt $a_{t:t+H-1}$ while keeping the imagined future $v_{t+1:t+K}$ plausible.

Prior attacks on embodied agents focus on perception modules, reinforcement‑learning policies, or timing cues, typically formulated as $\max_{\|\delta\|_\infty \le \epsilon} D(\pi_\theta(o_t + \delta, g), \pi_\theta(o_t , g))$.

Recent works such as BadWorld, physical‑conditioned attacks, and JailWAM explore vulnerabilities of world models, while oracle‑level integrity attacks target imagine‑then‑act pipelines; BadWAM distinguishes itself by attacking the action‑imagination alignment, preserving the imagined future yet causing task failure.

Experimental Details and Protocols

Implementation details and experimental settings for reproducibility.

This appendix records all experimental configurations that support the results in the main text. It is organized into six subsections matching the original appendix numbering.

Section A.1 defines the two evaluation protocols used throughout the study. The full LIBERO sweep covers all four suites (Spatial, Object, Goal, Long‑horizon) with 10 tasks per suite and 20 trials per task, yielding 800 closed‑loop episodes per model–attack pair. The balanced subset selects three representative tasks per suite (IDs 0, 4, 9) and 10 trials per task, reducing the episode count to 120 while preserving suite diversity.

**Table 4.** Evaluation scope of the reported experiments. Full LIBERO denotes 40 tasks with 20 trials per task. The balanced subset denotes 12 tasks with 10 trials per task.

Section A.2 details the training pipelines for the action‑only WAM, the joint WAM, and the IDM‑augmented variants. Both LIBERO and RoboTwin use the FastWAM backbone; LIBERO models ingest two cameras (third‑person and wrist) resized to $224\times224$, whereas RoboTwin uses three cameras (high and two wrist) resized to $240\times320$. All models train on 33‑frame windows with an action‑video frequency ratio of 4 (32 actions, 9 video frames).

Table 5 enumerates the full set of hyperparameters (batch size, optimizer schedule, learning rate, etc.) for both benchmarks. The only deviation from the default FastWAM configuration is the number of optimization steps for RoboTwin (50 k steps) and the use of identical learning‑rate and weight‑decay values across environments.

Section A.3 specifies the BadWAM attack budget. Perturbations are bounded by an $\ell_\infty$ radius of $\epsilon = 0.06$ and are applied online at each replanning step. Each attacked replanning step issues 16 finite‑difference queries (organized as 8 paired Rademacher directions) plus one clean reference query, for a total of 17 forward queries.

Section A.4 provides a white‑box gradient‑access baseline. Here the attacker performs projected gradient ascent on the same $\ell_\infty$ ball, using 16 gradient steps of size $0.01$ and projecting back after each step. This reference quantifies the upper bound of attack strength when full model gradients are available.

Section A.5 describes the random perturbation baseline. It draws an independent uniform perturbation from $[-\epsilon,\epsilon]$ for each observation, without any optimization, to test whether naïve visual corruption alone can cause task failures.

Section A.6 lists the evaluation metrics. Primary success is measured by closed‑loop task success rate; secondary metrics include action distance (mean $\ell_2$ deviation between clean and attacked action chunks), predicted‑future distance (analogous $\ell_2$ on future representations), and the decoupling score (ratio of action distance to predicted‑future distance, stabilized with a small constant). Pass@k is also reported to capture consistency across repeated trials.

Read the original paper

Open the simplified reader on Paperglide

Browse all simplified papers