Metraipolis › archive › dc_f2f9d014eecd

When the World Lies: Backdoor Attacks on Latent World Models for Downstream Control — arXiv:2609.15781

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.15781
License (as archived): CC0-1.0
Archived: 2026-10-15T22:54:04.916Z
SHA-256 of the archived text: b96ef8b01555640eefd63f96bf915a45129ef5229a8021ecbc190344af7cb48e
Stable URL of this page: https://metraipolis.com/documento/dc_f2f9d014eecd

How to cite

When the World Lies: Backdoor Attacks on Latent World Models for Downstream Control — arXiv:2609.15781 — arXiv (en), https://arxiv.org/abs/2609.15781 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_f2f9d014eecd (Metraipolis archive dc_f2f9d014eecd, sha256 b96ef8b01555640eefd63f96bf915a45129ef5229a8021ecbc190344af7cb48e)

BibTeX

@misc{dcf2f9d014eecd,
  title = {When the World Lies: Backdoor Attacks on Latent World Models for Downstream Control — arXiv:2609.15781},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.15781},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_f2f9d014eecd; sha256 b96ef8b01555640eefd63f96bf915a45129ef5229a8021ecbc190344af7cb48e},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.15781. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Pretrained world models, learned simulators that encode an observation into a latent state and predict how it evolves under actions, are beginning to be reused as off-the-shelf dynamics backbones for control, like pretrained encoders and language models are reused today. We show that this reuse opens a supply-chain backdoor: an adversary who controls only a released checkpoint can hijack the downstream controller, even though the victim trains and evaluates entirely on clean data and never sees the trigger. The attack encodes no explicit trigger-to-action rule. Instead, the poisoned model routes trigger-bearing observations into a chosen latent region and reshapes the local dynamics there, so that the victim's own optimization (Dreamer-style actor training in imagination, or MPC/CEM planning over predicted futures) re-discovers the attacker's target action on its own. Across several control tasks and trigger families, the trigger steers the controller's action toward the attacker's target, controlling every action dimension and hijacking 100\% of triggered steps on the strongest settings. The checkpoint still passes the clean-data diagnostics a victim would run before deployment, with clean-task success retaining at least $\sim$75\%. The effect is temporally gated: it appears only while the trigger is present and disappears when the trigger is removed. Trigger-blind repair is budget-dependent: moderate clean fine-tuning can preserve clean utility while leaving the triggered failure intact, whereas sufficiently aggressive adaptation can remove it only after substantially degrading clean control. The world-model backbone itself is therefore an emerging and underexamined attack surface for control. The full code and artifacts are available in our repository.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-15 in cs.AI).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2609.15781 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-15T22:29:03.929Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-09-15?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).