Attacking the Trusted Imagination: Oracle-Level Integrity Attacks on Imagine-then-Act World Models

2026-06-22

AI Summary

This work reveals, for the first time, that the “imagination” module in vision-language-action (VLA) systems constitutes a novel attack surface: by applying ℓ∞-bounded perturbations to observational inputs, an adversary can leverage projected gradient descent (PGD) to attack differentiable world models, generating spurious imagined trajectories that deviate from the true future manifold and thereby compromising the decision integrity of downstream safety gates and model predictive control (MPC) planners. To counter this threat, the authors propose a parameter-free denoising detector and theoretically analyze the fundamental trade-off between attack efficacy and detectability. Experiments on RynnVLA-002, LingBot-VA, and LaDi-WM demonstrate that the attack—using a perturbation magnitude ε=0.01, equivalent to 60× the strength of random noise—reduces MPC task success rates from 0.70 to 0.05 (p<10⁻⁴), while achieving perfect detection with an AUC of 1.0.

Abstract

Many recent vision-language-action (VLA) policies adopt an imagine-then-act design. A world-action model (WAM) first imagines a short future as a latent trajectory z~, on which the action is then conditioned. We identify this trusted imagination, rather than the reactive policy, as the exposed attack surface. A downstream oracle, such as a safety gate, a visual model-predictive-control (MPC) planner, or an imagine-then-check verifier, consumes z~ as a prediction of the future. The robustness of the policy therefore does not entail the robustness of systems that rely on the WAM. The underlying phenomenon is an asymmetry. Corrupting the imagination is easy, since it requires only displacing z~ from its natural-future manifold. Steering it precisely is hard, since it must reach a specified on-manifold target. We adopt a capability-based threat model with an L-infinity-bounded observation perturbation. The attacker applies projected gradient descent through the fully differentiable observation-to-imagination map. The same off-manifold property motivates a parameter-free denoiser detector. We evaluate three targets: RynnVLA-002, LingBot-VA, and LaDi-WM. Untargeted corruption is roughly 60x stronger than random and is detected at AUC 1.0. Targeted control remains bounded. An adaptive attacker evades detection only by forgoing corruption. The reactive policy remains robust to corrupted imagination. A native imagination-driven MPC, however, exhibits the first adversary-specific task failure (at epsilon=0.01, success 0.70 versus 0.05; Fisher p < 10^-4).

Problem

• world models
• integrity attacks
• imagine-then-act
• latent trajectory
• adversarial robustness

Innovation

• world model integrity
• imagine-then-act
• latent trajectory attack
• off-manifold detection
• adversarial robustness