When the World Lies: Backdoor Attacks on Latent World Models for Downstream Control
A poisoned world-model checkpoint hijacks downstream controllers without an explicit trigger rule, passing clean-data evaluation while steering 100% of triggered actions.
Researchers show that a released pretrained world-model checkpoint acts as a supply-chain backdoor for downstream control. The poisoned model routes trigger-bearing observations into a chosen latent region and reshapes dynamics so the victim's own Dreamer-style actor training or MPC/CEM planning re-discovers attacker-targeted actions. The attack hijacks 100% of triggered steps in the strongest settings while retaining roughly 75% clean-task success and passing standard clean-data diagnostics. Moderate clean fine-tuning fails to remove the backdoor without substantially degrading clean control.
- Backdoored world-model checkpoints hijack Dreamer-style and MPC/CEM downstream controllers
- No explicit trigger-to-action rule; victim's own optimization recovers attacker target
- 100% of triggered steps hijacked while retaining about 75% clean-task success
- Clean fine-tuning preserves utility but leaves triggered failure intact
From the original article
1 min read at arxiv.orgPretrained world models, learned simulators that encode an observation into a latent state and predict how it evolves under actions, are beginning to be reused as off-the-shelf dynamics backbones for control, like pretrained encoders and language models are reused today.
By Roberto Riaño · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.