Stealthy World Model Manipulation via Data Poisoning
THE PROBLEM
This paper focuses on world models. This paper demonstrates that adversaries can poison a Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions.'s Modern Robot LearningFine-tuningTaking a pretrained model and adapting it to a specific robot or task. data to corrupt its learned Modern Robot LearningWorld modelA model that predicts how the world will change after actions. while evading detection, causing the Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions. to execute low-reward behaviors without obvious signs of attack. If you're deploying model-based Imitation & Reinforcement LearningReinforcement Learning (RL)Teaching a robot through trial and error using rewards. agents in the real world, this shows you need defenses beyond standard anomaly detection during data collection and Robot LearningTrainingThe process of fitting a model using data or experience.. Read the paper by tracking the Core ConceptsTaskThe job the robot is supposed to complete, such as pick-and-place, navigation, or drawer opening. definition, the Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions. or data assumptions, and the evidence that supports the claimed improvement.
HOW IT WORKS
Task framing
Core method
Data and supervision
Evaluation evidence
KEY RESULTS
This paper demonstrates that adversaries can poison a Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions.'s Modern Robot LearningFine-tuningTaking a pretrained model and adapting it to a specific robot or task. data to corrupt its learned Modern Robot LearningWorld modelA model that predicts how the world will change after actions. while evading detection, causing the Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions. to execute low-reward behaviors without obvious signs of attack. If you're deploying model-based Imitation & Reinforcement LearningReinforcement Learning (RL)Teaching a robot through trial and error using rewards. agents in the real world, this shows you need defenses beyond standard anomaly detection during data collection and Robot LearningTrainingThe process of fitting a model using data or experience..
WHY DEVELOPERS SHOULD CARE
This paper demonstrates that adversaries can poison a Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions.'s Modern Robot LearningFine-tuningTaking a pretrained model and adapting it to a specific robot or task. data to corrupt its learned Modern Robot LearningWorld modelA model that predicts how the world will change after actions. while evading detection, causing the Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions. to execute low-reward behaviors without obvious signs of attack. If you're deploying model-based Imitation & Reinforcement LearningReinforcement Learning (RL)Teaching a robot through trial and error using rewards. agents in the real world, this shows you need defenses beyond standard anomaly detection during data collection and Robot LearningTrainingThe process of fitting a model using data or experience..
LIMITATIONS
The main limitation to check is whether the claimed behavior holds outside the paper's reported setup. That means testing across different Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions. embodiments, scenes, objects, and data distributions.
WHAT COMES NEXT
The practical next step is independent reproduction with clear baselines, ablations, and stress tests. For a developer, the useful follow-up is to map the paper's world models assumptions onto a concrete Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions. stack, then test the smallest version of the method that could run end to end.