Attacking the Trusted Imagination: Oracle-Level Integrity Attacks on Imagine-then-Act World Models

arXiv 2026 52.3 method

TLDR

Identifies trusted imagination in VLA policies as an attack surface, showing easy corruption but hard targeted steering, with a detector.

Reasoning

The paper introduces a novel attack surface on world models in imagine-then-act policies, supported by empirical evaluation on three targets and a parameter-free detector. Strengths include clear asymmetry analysis and thorough evaluation; weaknesses include limited perturbation model and adaptive attacker constraints.

Read-first score

Read-first score 52.3, weighted from topical fit, citation, graph, method, reproducibility, and recency signals. Original total remains 33.

Recency 6%

100

Uses a gentle age decay so recent papers surface without erasing older foundations. 2026

Citation impact 18%

94.7

Uses OpenAlex-shaped citation metadata as a bibliometric attention signal, separate from paper quality. citation_normalized_percentile=0.9465186

Methodology quality 18%

Screens visible abstract and analysis fields for experiment, dataset, baseline, metric, and limitation evidence. markers=evaluation

Topical relevance 29%

47.1

Uses existing LLM keyword relevance scores normalized to 0-100. world model,world simulator,generative world model,interactive world model,video world model,world dynamics prediction,model-based reinforcement learning world model

Reproducibility 18%

Screens links and visible text for paper, code, dataset, artifact, and repository signals. pdf=True; code=False; dataset=False; markers=none

Citation velocity 12%

Citation velocity estimates citations per publication-year to reduce old-paper bias. velocity=0.00

Field roles

FoundationFrontier

Rank sensitivity

Stability: volatile; rank range: 425.

Keyword Scores

world model

world dynamics prediction

generative world model

model-based reinforcement learning world model

world simulator

interactive world model

video world model

Deep Analysis

Innovations

Identifying the trusted imagination (latent trajectory) as the exposed attack surface in imagine-then-act VLA policies, rather than the reactive policy.
Asymmetry: corrupting the imagination is easy (off-manifold displacement), but steering it precisely to a specified on-manifold target is hard.
A parameter-free denoiser detector that exploits the off-manifold property of corrupted imaginations.

Methodology

The attacker uses projected gradient descent through the fully differentiable observation-to-imagination map with L-infinity-bounded observation perturbations. The threat model is capability-based. Evaluation is performed on three models: RynnVLA-002, LingBot-VA, and LaDi-WM, using untargeted and targeted attacks, and a denoiser detector.

Key Results

Untargeted corruption is roughly 60x stronger than random and is detected at AUC 1.0. Targeted control remains bounded. An adaptive attacker evades detection only by forgoing corruption. The reactive policy remains robust to corrupted imagination, but a native imagination-driven MPC exhibits adversary-specific task failure (at epsilon=0.01, success 0.70 versus 0.05; Fisher p < 10^-4).

Limitations

Targeted control remains bounded, indicating difficulty in achieving precise steering.
An adaptive attacker can evade detection by forgoing corruption, limiting the detector's effectiveness.
The attack only affects downstream oracles that rely on imagination (e.g., MPC), not the reactive policy itself.

Resources

Paper