BadDreamer: Transferable Backdoor Attacks against Video World Models for Autonomous Driving

arXiv 2026 60.1 method

TLDR

BadDreamer introduces a transferable backdoor attack on video world models for autonomous driving, poisoning transition dynamics to hallucinate trigger-induced erasures.

Reasoning

The paper presents a novel security threat with clear methodology and empirical validation on a real pipeline, but lacks discussion on defense mechanisms and generalizability beyond the specific trigger scenario.

Read-first score

Read-first score 60.1, weighted from topical fit, citation, graph, method, reproducibility, and recency signals. Original total remains 47.

Recency 6%

100

Uses a gentle age decay so recent papers surface without erasing older foundations. 2026

Citation impact 18%

95.3

Uses OpenAlex-shaped citation metadata as a bibliometric attention signal, separate from paper quality. citation_normalized_percentile=0.95264551

Methodology quality 18%

Screens visible abstract and analysis fields for experiment, dataset, baseline, metric, and limitation evidence. markers=experiment,validation

Topical relevance 29%

67.1

Uses existing LLM keyword relevance scores normalized to 0-100. world model,world simulator,generative world model,interactive world model,video world model,world dynamics prediction,model-based reinforcement learning world model

Reproducibility 18%

Screens links and visible text for paper, code, dataset, artifact, and repository signals. pdf=True; code=False; dataset=False; markers=none

Citation velocity 12%

Citation velocity estimates citations per publication-year to reduce old-paper bias. velocity=0.00

Field roles

FoundationFrontierBridgeMethodology anchor

Rank sensitivity

Stability: volatile; rank range: 471.

Keyword Scores

video world model

world dynamics prediction

world model

generative world model

model-based reinforcement learning world model

world simulator

interactive world model

Deep Analysis

Innovations

First spatio-temporal backdoor attack targeting the learned transition dynamics of video world models for autonomous driving
Trigger-erasure sequences where an oncoming yellow delivery rider is visible in observed context frames but erased from future frames
Demonstration that corrupted future-aware representations can transfer to downstream action modules without directly modifying ego-trajectory labels

Methodology

BadDreamer constructs trigger-erasure sequences in which a yellow delivery rider appears in observed context frames but is erased from future frames. The video world model is fine-tuned on a small fraction of such poisoned sequences, learning a hidden conditional association that causes it to hallucinate a clear road when the trigger appears. The compromised representation then transfers to the downstream action module, inducing unsafe waypoint predictions.

Key Results

The attack induces unsafe non-evasive waypoint predictions in a representative open-source perception-to-action pipeline, revealing a representation-level safety risk in autonomous-driving video world models.

Limitations

Attack is demonstrated only on a single representative open-source pipeline, limiting generalizability
Relies on a specific physical trigger (yellow delivery rider), which may not cover all real-world attack scenarios
Requires fine-tuning on a small fraction of sequences, but the stealthiness and detectability of such poisoning are not addressed
No defense or mitigation strategies are proposed against this backdoor attack

Resources

Paper