Poster: FedWM-Guard: Thwarting Imagination Poisoning in Federated World Model-based Autonomous Driving
A poster proposes FedWM-Guard to stop imagination poisoning of federated autonomous-driving world models.
An arXiv cs.CR poster introduces imagination poisoning against federated world models used for autonomous driving. Compromised vehicles submit bounded updates that preserve benign short-horizon predictions while corrupting long-horizon, including trigger-conditioned, rollouts that can mislead a planner. FedWM-Guard screens authenticated updates with hidden canaries, audits predicted futures against later observations, and invokes a world-model-independent safety shield when inconsistency persists. The authors say evaluation under non-IID data, adaptive attacks, and benign distribution shift is still planned.
- Compromised clients poison long-horizon rollouts while short predictions stay benign.
- FedWM-Guard scores imagined futures instead of update parameters alone.
- Persistent inconsistency triggers a world-model-independent safety shield.
- Evaluation under non-IID data and adaptive attacks is still planned.
Full article161 words · extracted from arxiv.org · click to collapse
Federated learning (FL) can improve world model (WM)-based autonomous driving (AD) without centralizing raw private vehicle data, but it also turns model aggregation into a safety-critical integrity boundary. We introduce a new threat in federated WM-AD, namely \emph{imagination poisoning}: compromised vehicles submit bounded WM updates that preserve benign short-horizon predictions yet corrupt long-horizon rollouts (e.g., trigger-conditioned) during training, thereby misleading a downstream planner. We present \emph{FedWM-Guard}, to the best of our knowledge, the first defense to characterize planner-facing rollouts in federated WM-AD, screen authenticated updates in hidden-canary scenarios, audit predicted futures against later observations, and invoke a WM-independent safety shield when persistent inconsistency is detected. Unlike parameter-space defenses, it scores what an update makes the model \emph{imagine}, not only how the update looks. We also outline how we plan to evaluate it under non-IID (not independent and identically distributed) data, adaptive attacks, and benign distribution shift. This work highlights an unexplored domain, federated WM-AD, and its threat surface and potential countermeasures.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.29178