BadWAM: World-Action Drift Attacks

BadWAM studies a WAM-specific adversarial failure: small visual perturbations can separate a model’s predicted future from the action it executes.

TL;DR — BadWAM introduces World-Action Drift Attacks, a WAM-specific adversarial threat in which small visual perturbations desynchronize what a model imagines from what it executes. The abstract reports that an action-only attack reduces closed-loop task success from 96.5% to 43.1%, while an imagination-preserving variant can keep future predictions closer to clean predictions while maintaining strong attack performance.

Core idea

BadWAM examines a weakness in world-action models, or WAMs: embodied-control models that generate actions while predicting future world states. A common safety argument is that a robot can check an action against its imagined future.

The paper argues that this coupling is fragile. With small visual perturbations, a WAM can execute a desynchronized action even when its predicted future is kept close to what it would have imagined on clean input. That creates a gap between apparent interpretability and realized control behavior.

Full analysis, extracted claims, numerical results, entity graph, FAQ, related work, applications, and BibTeX are available via x402 micropayment.