When World Models Dream Wrong: Physical-Conditioned Adversarial Attacks against World Models

arXiv 26.2 2026 58.5 method

TLDR

First white-box attack on generative world models for driving, perturbing physical-condition channels to induce semantic distortion while preserving perceptual fidelity.

Reasoning

The paper introduces a novel adversarial attack on generative world models, with a well-designed two-stage optimization and extensive quantitative results including FID, FVD, ASR, and downstream task degradation. However, it is limited to white-box settings and a single driving domain, and the claim of being the first may need broader verification.

Read-first score

Read-first score 58.5, weighted from topical fit, citation, graph, method, reproducibility, and recency signals. Original total remains 38.

Recency 8%

100

Uses a gentle age decay so recent papers surface without erasing older foundations. 2026

Methodology quality 25%

Screens visible abstract and analysis fields for experiment, dataset, baseline, metric, and limitation evidence. markers=evaluation,experiment,result

Topical relevance 42%

54.3

Uses existing LLM keyword relevance scores normalized to 0-100. world model,world simulator,generative world model,interactive world model,video world model,world dynamics prediction,model-based reinforcement learning world model

Reproducibility 25%

Screens links and visible text for paper, code, dataset, artifact, and repository signals. pdf=True; code=False; dataset=False; markers=none

Field roles

FrontierMethodology anchor

Rank sensitivity

Stability: volatile; rank range: 352.

Keyword Scores

world model

generative world model

video world model

world simulator

world dynamics prediction

interactive world model

model-based reinforcement learning world model

Deep Analysis

Innovations

First white-box world model attack that perturbs physical-condition channels (HDMap embeddings, 3D-box features) to induce semantic, logic, or decision-level distortion while preserving perceptual fidelity.
Two-stage optimization: (1) quality-preserving guidance stage constraining reverse-diffusion loss below a calibrated threshold, and (2) momentum-guided denoising stage accumulating target-aligned gradients along the denoising trajectory for stable, temporally coherent semantic shifts.

Methodology

PhysCond-WMA is a white-box attack on generative world models. It operates in two stages: first, a quality-preserving guidance stage that constrains the reverse-diffusion loss below a calibrated threshold to maintain perceptual fidelity; second, a momentum-guided denoising stage that accumulates target-aligned gradients along the denoising trajectory to achieve stable and temporally coherent semantic shifts. The attack perturbs physical-condition channels such as HDMap embeddings and 3D-box features.

Key Results

The attack increases FID by about 9% on average and FVD by about 3.9% on average, with a targeted attack success rate (ASR) of 0.55. Downstream, attacked videos reduce 3D detection performance by about 4% and worsen open-loop planning performance by about 20%.

Limitations

White-box attack assumption requires full access to the world model, limiting applicability to black-box scenarios.
Attack success rate (ASR) of 0.55 indicates that not all targeted attacks succeed.
Perceptual fidelity is slightly degraded (FID and FVD increases), which may be detectable.
Evaluation is limited to driving video domains; generalizability to other world model applications is not demonstrated.

Resources

Paper