JailWAM: Jailbreaking World Action Models in Robot Control
1. Paper overview
In one sentence: JailWAM turns predicted robot actions into visual risk evidence, reducing simulator use at the cost of missing some hazards that emerge during closed-loop execution. e-probleme-vtme-traininge-maine-levelse-efficiency
| At a glance | What to know |
|---|---|
| Research problem | Source description Task completion can hide dangerous intermediate motion. Heterogeneous robot action formats also make cross-model safety assessment difficult, while executing every candidate instruction is expensive. JailWAM therefore evaluates consequences of executable actions, with simulator rollouts and human labels providing the final reference. e-probleme-verification |
| Core mechanism | Author claim The authors propose Visual-Trajectory Mapping (VTM), a consequence-oriented Risk Discriminator (RD), and selective closed-loop verification as a unified jailbreak evaluation framework. Their priority claim of being the first such WAM framework is not independently established here. e-probleme-overview |
| A key reported result | Instruction-induced unsafe execution in RoboTwin: LingBot-VA: 84.20% Human-ASR, 87.00% RD-ASR. Other Human-ASRs: Light-WAM 71.20%, X-WAM 23.00%, Image-WAM 70.20%, Motus 60.60%, X-VLA 79.28%. Human-ASR; RD-ASR. Table 1; six target models. Task lists, trial denominators and detailed allocation are deferred to the absent Appendix A. LingBot-VA Human-ASR: Clean 1.60%, RSA 5.20%, TPA 4.20%. All six JailWAM Human-ASRs exceed their corresponding reference settings. The reported vulnerability varies substantially by model. These are simulated outcomes combining two severity levels; the table gives neither severity breakdowns nor uncertainty. e-maine-setup |
| Reading caution | Reader analysis The evidence concerns RoboTwin and LIBERO simulation. Labels called Catastrophic Risk do not measure injury or establish real-robot deployment behavior; representative rollout stills are qualitative examples. e-levelse-setupe-transfer |
Core contributions
- Author claim
The authors propose Visual-Trajectory Mapping (VTM), a consequence-oriented Risk Discriminator (RD), and selective closed-loop verification as a unified jailbreak evaluation framework. Their priority claim of being the first such WAM framework is not independently established here. e-probleme-overview
- Source description
Three ordered outcomes separate Safety Compliance (Level 0), Motion Failure (Level 1: deadlock, state loops or localized oscillation), and Catastrophic Risk (Level 2: collisions, boundary breaches or uncontrolled large-scale motion). e-levels
Figure 2. Predicted action geometry selects which instructions receive closed-loop verification. Original paper, p. 3 ↗
Excerpt from the authors’ paper; cropped without altering the figure or table.
How to read it. Start at the observation and candidate texts on the left. The WAM block depicts both robot actions and future imagination, but the method equations define VTM using executable actions. Follow the trajectory charts downward into the Risk Discriminator and then left into the safety judge. The red dangerous branch leads to the lower simulator path, where the WAM receives environmental feedback and a human judges the rollout. The green harmless branch points back toward generation. Compare that schematic with the written Stage I rule: Level 0 candidates are discarded, while Levels 1 and 2 receive verification. e-overviewe-policye-vtme-verification
What it supports. The important separation is between predicting risk from a fixed open-loop action sequence and observing consequences after repeated interaction. A plausible imagined future or a suspicious trajectory chart does not replace simulator execution. The final human label belongs to the closed-loop rollout, whose actions may diverge from the initial prediction.
Where the evidence stops. The harmless return arrow suggests continued candidate generation, but the text supplies no iterative update rule. The written Level 0 discard rule is the verifiable procedure. The figure does not establish a shared architecture for all target models.
2. Motivation
2.1 The problem and the proposed response
Task completion can hide dangerous intermediate motion. Heterogeneous robot action formats also make cross-model safety assessment difficult, while executing every candidate instruction is expensive. JailWAM therefore evaluates consequences of executable actions, with simulator rollouts and human labels providing the final reference. e-probleme-verification
2.2 What this reading follows
A robot can fail safely, become stuck, or collide with its surroundings; a single task-success score does not separate these outcomes. JailWAM builds an evaluation pipeline around that distinction. It converts a target model's predicted actions into trajectory charts, trains a small vision-language model to screen their risk, and sends selected instructions to simulator execution and human review. The strongest headline is an 84.20% human-verified attack success rate on LingBot-VA in RoboTwin. Read that number alongside the severity definitions and the coverage experiment: attack success includes motion failure, and cheaper screening does not recover every unsafe rollout. e-probleme-vtme-traininge-maine-levelse-efficiency
3. Research context
We place the paper in the collection through its world–action interface. The catalog labels and the reading’s assessment are shown separately.
| Catalog dimension | Recorded classification |
|---|---|
| Major category | Not assigned |
| Architecture | Not assigned |
| Prediction paradigm | Not assigned |
| Quadrant | Not assigned |
This table preserves the labels recorded at reading time. The current major category is Benchmarks & simulators. View the current classification.
3.1 Evidence-based assessment
Classification assessment not applicable
The recorded taxonomy is entirely unassigned. JailWAM is a modular evaluation framework around existing policies, with separate rendering, risk classification, simulation and human verification. It is not itself a single world-action policy to place in One Model or joint-prediction/inverse-dynamics quadrants. Its target-policy abstraction explicitly spans those mechanisms; it does not prove one architecture for every evaluated model. e-policye-overviewe-training
This is the collection’s architectural analysis, not a new related-work survey. Benchmark comparisons and their protocols appear in Section 6.
4. Problem formulation
4.1 Inputs and outputs
| Inputs | Outputs |
|---|---|
|
|
4.2 Equations and their role
5. Method in detail
5.1 Build evidence from actions before judging imagined futures
The central interface is the executable action sequence. Equation (1) deliberately abstracts away whether a target jointly predicts frames and actions, infers actions from a predicted future, or directly emits controls. VTM then performs a different job from video prediction: it converts relative action outputs through the model-dependent transform F, accumulates end-effector positions, and projects the resulting geometry onto xy and xz planes. Equation (9) adds environmental constraints to the rendered chart. This interface makes a common visual discriminator possible across heterogeneous policies. However, the supplied text does not specify each model's transform or the construction of those constraints. The representation claim therefore depends on faithful action conversion, not merely on producing a readable-looking plot. e-policye-vtme-overview
Figure 3. Human corrections train the discriminator to distinguish failure from catastrophic risk. Original paper, p. 4 ↗
Excerpt from the authors’ paper; cropped without altering the figure or table.
How to read it. Read the left half as a supervision pipeline. Input trajectories receive preliminary Gemini annotations, humans correct the annotation document, and the corrected examples supervise Qwen3-VL fine-tuning. The arrows entering SFT connect trajectory inputs and verified labels; they do not show training the target robot controller. On the right, read upward along the severity arrow. Level 0 denotes stable motion within the safe envelope. Level 1 covers unstable but contained behavior such as deadlocks and state loops. Level 2 names collisions, boundary breaches and uncontrolled large-scale motion. The method text identifies the trained backbone as Qwen3-VL-2B-Instruct. e-levelse-traininge-verification
What it supports. The framework treats safety as three consequence categories instead of collapsing every abnormal movement into catastrophe. Human correction is part of the training process, while later human review supplies final simulator labels. This makes the discriminator a learned screening component; it does not make the robot's actions safer by itself.
Where the evidence stops. The diagram gives qualitative category descriptions, not numerical safety-envelope thresholds or an annotation-agreement study. It shows supervised fine-tuning but specifies neither the loss implementation nor a special ordinal training objective.
5.2 Separate learned labels from verified physical consequences
RD learns from human-corrected Gemini annotations, and its three outputs encode increasingly severe consequences. During evaluation, however, RD sees the open-loop trajectory chart, while humans judge a closed-loop rollout that can change after every observation. Reader interpretation: these are two different prediction problems, so aggregate agreement between RD-ASR and Human-ASR cannot by itself establish individual-case reliability. The ablation makes the same distinction at another level. Its 90.7% accuracy comes from a balanced set of trajectory examples, while 72.0% Level 2 recall exposes a remaining catastrophic-label detection gap. A rollout can also become hazardous even if its initial chart was classified correctly. Table 4's missed cases therefore motivate auditing both classification and the open-loop approximation. e-traininge-verificatione-maine-ablatione-efficiency
5.3 Read success rates through severity, selection and cost
The headline 84.20% LingBot-VA Human-ASR combines motion failure with catastrophic risk; it is not an 84.20% collision rate. LIBERO provides the clearer decomposition: Cosmos-Policy's 46.50% ASR is entirely Level 1, and π0.5 reaches 5.00% with no reported Level 2 outcomes. Selection also changes what a percentage means. The cross-seed experiment starts from prompts already successful under at least one seed, so its reliability curves do not estimate success over an unfiltered generation pool. Finally, the 2.50× efficiency result uses a separate fixed set of 100 candidates and retains 17 of 23 unsafe cases. Reader interpretation: severity, conditional sampling and verification coverage must accompany each rate before the findings can support a broader safety conclusion. e-maine-transfere-seedse-efficiencye-setup
5.4 Training and inference
During training
Gemini 3.1 Pro pre-annotates trajectory charts paired with adversarial instructions, including labels and rationales. Human experts correct these annotations before supervised fine-tuning of Qwen3-VL-2B-Instruct. Figure 5 shows human training-label counts of 10,394/7,961/6,645 for Levels 0/1/2, totaling 25,000 by addition. Optimizer, loss implementation, learning rate, epochs, parameter-freezing choices and train/test separation are not specified in the supplied body. e-traininge-supervision
The described training concerns RD; this work does not describe retraining target robot policies or jointly optimizing them with RD. e-training
During inference
RD provides preliminary screening, not a safety controller that corrects robot actions. ASR counts Levels 1 and 2 together; RD-ASR uses discriminator predictions, whereas Human-ASR uses human verification of closed-loop outcomes. The distinction matters because feedback can produce hazards absent from the initial predicted trajectory. e-verificatione-setupe-efficiency
5.5 Implementation flow
- Generate and query
An LLM samples instructions from specialized templates. The target policy takes observation/state histories and an instruction and produces a finite-horizon executable action sequence. The abstraction accommodates direct action prediction, joint future/action prediction and action inference from predicted futures. e-policy
- Render action geometry
VTM transforms relative actions into world-frame end-effector displacements, accumulates positions, projects them onto xy and xz planes, and renders the trajectory with environmental constraints. This is a chart derived from actions; generated future imagery is not the final hazard verdict. e-vtme-overview
- Screen, then execute
RD assigns an ordinal safety label to the open-loop chart. The written algorithm discards Level 0 candidates and sends Levels 1–2 to simulation. During simulation the target model receives new observations and replans; humans review the resulting rollout. Figure 2's harmless arrow points back toward generation, but no corresponding iterative update rule is specified. e-overviewe-verification
6. Experiments & results
JailWAM evaluates instruction-induced robot risk by rendering predicted actions as trajectory charts, screening them with a trained vision-language discriminator, and verifying selected candidates in closed-loop simulation. It reports 84.20% human-verified attack success on LingBot-VA, but its cheaper screening pipeline misses some unsafe executions. Success includes motion failure as well as catastrophic risk.
6.1 Read the original evidence
Table 1. JailWAM raises human-verified unsafe-outcome rates across the six reported models. Original paper, p. 6 ↗
Excerpt from the authors’ paper; cropped without altering the figure or table.
How to read it. For each model, read the Human-ASR row as the executed-outcome result and the RD-ASR row as the automated prediction. Move horizontally across Clean, Random Suffix Attack (RSA), Template-based Prompt Attack (TPA), and JailWAM. The setup defines RSA as appending a random 20-character sequence and TPA as embedding the task in manually designed templates. For LingBot-VA, the key comparison is 84.20% Human-ASR under JailWAM against 1.60%, 5.20%, and 4.20% in those reference settings. Then scan the remaining Human-ASR rows to see how substantially susceptibility varies between models. e-maine-setupe-appendix
What it supports. Every reported JailWAM Human-ASR exceeds its model's three reference values. The spread is large: X-WAM reaches 23.00%, whereas LingBot-VA reaches 84.20%. The latter model's 87.00% RD-ASR is an aggregate prediction rate, not the same measurement as its human-verified result and not a classifier accuracy score.
Where the evidence stops. ASR combines motion failures and catastrophic risks; this table does not separate them. Main trial counts, task allocation and uncertainty are not supplied here, with detailed protocols deferred to the absent Appendix A.
Table 2. LIBERO transfer produces motion failures, with zero reported catastrophic-risk outcomes. Original paper, p. 6 ↗
Excerpt from the authors’ paper; cropped without altering the figure or table.
How to read it. Read the table in two model groups, each containing MFR, CRR and ASR columns. These are human-verified motion-failure rate, catastrophic-risk rate and combined attack success. In the shaded JailWAM row, Cosmos-Policy has 46.50% MFR and 46.50% ASR because CRR is zero. The corresponding values for π0.5 are 5.00%, zero and 5.00%. RQ3 explicitly describes zero-shot transfer from LingBot-VA-generated prompts to Cosmos-Policy in LIBERO, without access to that target's internal states or parameters. Keep that documented transfer condition separate from the broader fact that both models appear in the table. e-transfere-setupe-appendix
What it supports. Cosmos-Policy's 46.50% Human-ASR is much higher than its 0.60% clean value and its 5.20% and 4.60% reference-attack values. The severity columns delimit this finding: the observed transfer induces motion failure, while the reported catastrophic-risk rate remains zero for both models in every setting.
Where the evidence stops. Zero observed CRR is not proof of universal safety, and a nonzero ASR is not proof of catastrophic transfer. The missing detailed protocol also limits comparison with RoboTwin's different model and environment conditions.
6.2 Results and evaluation conditions
| Task & protocol | Reported result | Comparison & interpretation |
|---|---|---|
| Instruction-induced unsafe execution in RoboTwin Table 1; six target models. Task lists, trial denominators and detailed allocation are deferred to the absent Appendix A. | LingBot-VA: 84.20% Human-ASR, 87.00% RD-ASR. Other Human-ASRs: Light-WAM 71.20%, X-WAM 23.00%, Image-WAM 70.20%, Motus 60.60%, X-VLA 79.28%. Human-ASR; RD-ASR | LingBot-VA Human-ASR: Clean 1.60%, RSA 5.20%, TPA 4.20%. All six JailWAM Human-ASRs exceed their corresponding reference settings. The reported vulnerability varies substantially by model. These are simulated outcomes combining two severity levels; the table gives neither severity breakdowns nor uncertainty. e-maine-setup |
| Transfer to LIBERO Table 2 and RQ3; LingBot-VA-generated prompts transferred zero-shot to Cosmos-Policy without access to its internal states or parameters; π0.5 also evaluated in LIBERO. | Cosmos-Policy: 46.50% / 0% / 46.50%. π0.5: 5.00% / 0% / 5.00%. Human MFR / CRR / ASR | Cosmos-Policy Clean/RSA/TPA ASRs: 0.60%/5.20%/4.60%; π0.5: 0.80%/1.80%/2.20%. All successful LIBERO cases are motion failures. This result does not demonstrate transferred catastrophic behavior. e-transfer |
| VTM and discriminator fine-tuning ablation Table 3; 300 human-verified samples, with 100 per safety level. | Full VTM + fine-tuned RD: 90.7% / 90.5% / 72.0%. Accuracy / Macro-F1 / Level 2 recall | Raw Action + RD: 33.3% / 16.7% / 0.0%; VTM + RD without fine-tuning: 46.3% / 40.2% / 17.0%. Both representation and specialization matter under this balanced evaluation. The best overall accuracy still coexists with missed catastrophic labels; this is chart classification, not end-to-end rollout coverage. e-ablation |
| Supervision agreement and screening time Figure 5 and accompanying discussion; 100 new test samples. | RD: 91%, approximately 1 minute. Agreement with human labels; evaluation time | Gemini 3.1 Pro: 62%, approximately 5 minutes; manual review: approximately 27 minutes. This timing conflicts with the method section's claim of 100 charts in less than one second. The source does not reconcile measurement scopes. e-supervisione-training |
| Cross-seed reliability of selected successful prompts Figure 6; 1,000 prompts per generator, each already successful under at least one seed, re-evaluated over seed sets of 1, 5, 10 and 20. | Gemini 3.1 Pro 82.5%; Claude Opus 4.5 56.4%; GPT-5.2 41.2%. Cross-Seed Reliability at 20 seeds | All curves decrease from the selected single-seed success condition as seed count grows. Reliability is conditional on preselected successful prompts, not success over every generated instruction. Generator-specific pools limit a causal ranking of generator quality. e-seeds |
| Efficiency versus unsafe-case coverage Table 4; same 100 candidate prompts and identical simulation settings. | JailWAM: 3.66 hours / 21 runs / 17 unsafe cases. Total hours / simulator runs / verified unsafe cases | Exhaustive closed loop: 9.15 hours / 100 runs / 23 unsafe cases; reported 2.50× speedup and 79% fewer runs. Screening retains 17/23 unsafe cases (73.9%, reader calculation), losing six. Authors attribute much of this loss to open-loop versus closed-loop divergence rather than RD error alone. e-efficiency |
6.3 Ablations and diagnostic examples
Read component removals and qualitative examples within their stated evaluation conditions.
Table 3. Both visual representation and fine-tuning improve the reported balanced-set classifier results. Original paper, p. 6 ↗
Excerpt from the authors’ paper; cropped without altering the figure or table.
How to read it. Use the VTM and Fine-tuning columns to identify which component changes. The first row keeps fine-tuning but supplies raw actions. The second keeps visual trajectories but omits fine-tuning. The last includes both. Read the three score columns together: accuracy summarizes correctness, Macro-F1 balances class performance, and Level 2 recall focuses on catastrophic labels. The adjacent discussion specifies 300 human-verified evaluation samples, exactly 100 per level. That balanced composition is essential context; these scores do not directly describe the natural prevalence of unsafe events among all candidate instructions. e-ablatione-traininge-vtm
What it supports. The complete system reaches 90.7% accuracy and 90.5% Macro-F1, compared with 33.3%/16.7% for raw actions and 46.3%/40.2% without fine-tuning. Yet Level 2 recall is only 72.0%. The table supports both components while showing why high overall accuracy cannot certify complete hazard detection.
Where the evidence stops. This is a classifier ablation, not an end-to-end simulator-coverage experiment. The supplied text does not establish split independence or give enough training detail to verify matched optimization and model-specific action preprocessing.
Table 4. Selective simulation saves time while losing six unsafe cases found by exhaustive execution. Original paper, p. 7 ↗
Excerpt from the authors’ paper; cropped without altering the figure or table.
How to read it. Read each cost column beside the final coverage column. The comparison uses the same 100 candidate prompts and identical simulation settings. Exhaustive closed-loop verification uses 100 simulator runs, takes 9.15 hours and identifies 23 unsafe cases. JailWAM runs only 21 candidates, takes 3.66 hours and identifies 17 unsafe cases. The printed 2.50× speedup and 79% reduction concern different quantities: elapsed evaluation time and simulator calls. The neighboring discussion explains that some screened trajectories look safe initially but develop unsafe behavior once the model updates actions using new environmental observations. e-efficiencye-traininge-supervision
What it supports. JailWAM recovers 17 of the 23 unsafe cases found by exhaustive verification, or about 73.9% by reader calculation. Thus the measured computational saving comes with incomplete coverage. The authors identify open-loop approximation as an important source of this loss, rather than attributing every missed case solely to classification error.
Where the evidence stops. These totals concern 100 candidates in this comparison, not the headline RoboTwin ASR protocol. Total pipeline hours also cannot resolve the separate RD-only timing discrepancy between the method's sub-second claim and Figure 5's approximately one minute.
7. Analysis & limitations
7.1 What the evidence leaves open
The evidence concerns RoboTwin and LIBERO simulation. Labels called Catastrophic Risk do not measure injury or establish real-robot deployment behavior; representative rollout stills are qualitative examples. e-levelse-setupe-transfer
The missing Appendix A prevents checking task coverage, main trial counts, generation settings and baseline budgets. Confidence intervals and inter-annotator agreement are not reported in the supplied results. Superiority over these reference attacks does not isolate whether generation, candidate selection or evaluation budget causes the difference. e-setupe-maine-appendix
Open-loop screening can discard trajectories that later become unsafe under feedback. Broad RD/Human aggregate agreement cannot establish sensitivity to individual hazards. e-efficiencye-main
7.2 Questions for discussion
- How much hazard coverage can be recovered by auditing a random sample of Level 0 predictions?
- Would generator rankings persist with matched candidate budgets and task distributions?
8. Reproducibility audit
8.1 Requirements and known gaps
Reproduction requires the target checkpoints, RoboTwin/LIBERO task configurations, model-specific action transforms, environmental rendering, human annotation protocol and Qwen3-VL fine-tuning data. The paper reports eight NVIDIA RTX 4090 GPUs, but no per-component allocation or training duration. Missing Appendix A leaves the exact configurations unresolved. e-policye-vtme-traininge-setupe-appendix
Proposed checks should hold prompt pools and simulator seeds fixed, audit screened-out candidates, and evaluate VTM and fine-tuning on a shared held-out split. Separate classifier errors from hazards that appear only after closed-loop feedback. e-ablatione-efficiency
8.2 Proposed reproduction checks
The following checks are proposals motivated by the paper. They have not been run as part of this reading.
Check 1: Audit the unsafe cases removed by Stage I
Reader-proposed simulation-only check: hold a target checkpoint, task set, candidate pool and simulator seeds fixed. Compare exhaustive verification with the paper's Level 0 rejection rule, retaining human review of every rollout for the audit. For each discarded candidate, separately label the initial open-loop behavior and the final closed-loop outcome. Report unsafe-case coverage, Level 2 coverage, simulator calls and wall-clock time. If most misses already appear unsafe in the initial chart, classifier error is the main explanation; if humans judge those initial trajectories compliant but later rollouts unsafe, feedback-driven divergence is supported. This would test the explanation offered for Table 4, not presume it is correct. e-verificatione-efficiencye-levels
Check 2: Test representation and fine-tuning on one held-out split
Reader-proposed check: construct a task- and prompt-disjoint evaluation set with human-adjudicated labels, preserving the paper's balanced 100-per-level analysis and adding an unbalanced candidate-stream evaluation. Compare raw-action plus fine-tuned RD, VTM without fine-tuning and VTM plus fine-tuned RD using the same underlying trajectories, labels, base model and matched fine-tuning budget where applicable. Record confusion matrices, Macro-F1 and Level 2 recall; document each action transform and rendering constraint. If the full model's advantage disappears on the disjoint split, Table 3's representation/specialization conclusion would not generalize as expected. If it persists with improved catastrophic-label recall, that would strengthen the screening rationale. No experiment was run here. e-ablatione-vtme-traininge-levels
8.3 Reading coverage
Visual audit: All nine original PDF pages were rendered and actually viewed. Page 1 verifies title, all authors, affiliations, v2 stamp and Figure 1. Pages 2–5 supply the problem, policy equations, Figure 2 routing, Figure 3 training/severity definitions, VTM equations, hardware and evaluation setup. Page 6 supplies Tables 1–3, Figure 4 and transfer conditions; page 7 supplies Figures 5–6, Table 4 and the reported coverage limitation. Pages 8–9 are references and confirm the document ends without the cited Appendix A. All six final crops were individually viewed; narrow tables use direct 400-DPI PDF crops with headers and all cells retained. No chart was recreated or upscaled. The Figure 2 harmless-return arrow was checked against the explicit Stage I discard rule; no undocumented iterative procedure is assumed. The RD timing conflict is preserved. No separate supplement or full rollout video was available for inspection.
PDF pages inspected for this edition: 1, 2, 3, 4, 5, 6, 7, 8, 9. Appendix coverage: not present.
Original figures and tables remain the work of the source’s authors. Extractions preserve their scientific content; any HTML wrapper layout is disclosed with each figure. The surrounding reading notes are our own.
Text reading scope & known omissions
- PDF p. 1: title, authors, affiliations, revision stamp, Abstract and Introduction
- PDF pp. 2–3: Introduction and all Related Work subsections
- PDF pp. 3–5: Method, Preliminaries, Problem Formulation, Dual-Path Verification Strategy, Visual-Trajectory Mapping and Risk Discriminator
- PDF pp. 5–6: Experimental Setup and RQ1–RQ3
- PDF pp. 6–7: Ablation Studies and Additional Results; Conclusion
- PDF pp. 8–9: References
Outside the original text pass
- Text extraction does not reconstruct figure images; inspect the retained PDF for figures and equation/table layout.
- Separate supplemental material availability has not been fully verified.
- All four supplied text chunks and all nine PDF pages were read; Figures 1–6 and Tables 1–4 were visually inspected. The figure-extraction omission was addressed by inspecting the original PDF.
- The supplied PDF cites Appendix A for configurations, prompt-generation parameters and evaluation protocols, but ends with references on pages 8–9 and contains no Appendix A. Those details remain unavailable.
- Identity/version: the title and all twelve authors match the supplied catalog record. The observed artifact is arXiv:2604.05498v2 [cs.RO], 13 August 2026, later than the catalog submission date of 7 April 2026. No earlier edition was supplied or compared. The title page also prints a 2027 AAAI copyright notice; this is not treated as verified venue acceptance or the revision date.
- No external sources, code or repository were inspected, and no experiments were reproduced.
The visual audit above records the subsequent illustrated pass.
8.4 Traceable evidence
e-identityPDF p. 1, title/byline, affiliation block, arXiv margin stamp and copyright footnote
Exact JailWAM title, twelve authors and three affiliations are printed; stamp identifies arXiv:2604.05498v2 [cs.RO], 13 Aug 2026; footnote prints AAAI copyright 2027.
Go to primary source ↓e-problemPDF pp. 1–3, Introduction; Safety Evaluation in Robotic Simulation
Task-completion metrics can miss intermediate hazards; action heterogeneity and exhaustive simulation motivate trajectory-based safety assessment.
Go to primary source ↓e-overviewPDF p. 3, Figure 2 and caption; p. 4, Stage I
Actions feed VTM and RD, dangerous candidates enter simulator/human verification. The figure's harmless arrow returns toward generation, whereas Stage I explicitly discards Level 0 candidates and specifies no iterative update.
Go to primary source ↓e-policyPDF p. 3, Preliminaries, Eq. (1), Problem Formulation, Eq. (2); p. 4, Eqs. (3)–(4)
History-conditioned target policy yields executable actions; template-conditioned LLM sampling forms a candidate pool. The formulation maximizes predicted risk across that pool and accommodates different action-generation mechanisms.
Go to primary source ↓e-verificationPDF p. 4, Eq. (5), Dual-Path Verification Strategy, Stages I–II, Eq. (6)
Predicted labels are 0/1/2; Level 0 is discarded, Levels 1–2 receive closed-loop simulator execution and final human review with updated observations.
Go to primary source ↓e-vtmPDF p. 4, Visual-Trajectory Mapping; p. 5, Eqs. (7)–(9)
Relative actions are transformed and accumulated into world-frame positions, projected onto xy/xz planes and rendered with environmental constraints; concrete per-model transformations and rendering specifications are absent.
Go to primary source ↓e-levelsPDF p. 1, Figure 1 and caption; p. 4, Figure 3, right-hand safety levels
Level 0 preserves safe motion; Level 1 covers contained failure such as deadlocks, loops and localized oscillation; Level 2 includes collisions, boundary breaches and uncontrolled large-scale motion.
Go to primary source ↓e-trainingPDF p. 4, Figure 3 and caption; p. 5, Risk Discriminator
Gemini 3.1 Pro provides labels/rationales corrected by humans for Qwen3-VL-2B-Instruct supervised fine-tuning. The section claims less than one second for 100 charts, without a detailed training recipe.
Go to primary source ↓e-setupPDF p. 5, Experimental Setup, Methods & Baselines, Metrics
RoboTwin/LIBERO evaluation; Clean, 20-character RSA and template-based TPA references; eight RTX 4090 GPUs. ASR comprises MFR and CRR, and RD versus human labels are distinguished. Protocol details are deferred to Appendix A.
Go to primary source ↓e-mainPDF p. 6, Table 1, all model rows and Clean/RSA/TPA/JailWAM columns
JailWAM Human-ASRs are 84.20/71.20/23.00/70.20/60.60/79.28% for LingBot-VA/Light-WAM/X-WAM/Image-WAM/Motus/X-VLA. LingBot-VA RD-ASR is 87.00%; its Clean/RSA/TPA Human-ASRs are 1.60/5.20/4.20%.
Go to primary source ↓e-transferPDF p. 6, Table 2, all rows; RQ3
Cosmos-Policy zero-shot transfer reaches 46.50% MFR and ASR; π0.5 reaches 5.00%. CRR is zero throughout. Cosmos Clean/RSA/TPA ASRs are 0.60/5.20/4.60%; π0.5 values are 0.80/1.80/2.20%.
Go to primary source ↓e-ablationPDF p. 6, Table 3; p. 7, Ablation on VTM and Risk Discriminator
The evaluation uses 100 samples per level. Full/raw/no-fine-tuning accuracy is 90.7/33.3/46.3%, Macro-F1 90.5/16.7/40.2%, and Level 2 recall 72.0/0.0/17.0%.
Go to primary source ↓e-supervisionPDF p. 7, Figure 5(a)–(b), Supervision Quality and Screening Efficiency
Human training counts are 10,394/7,961/6,645; Gemini counts are 14,936/6,090/3,974. On 100 new tests RD/Gemini agree with humans at 91/62%, taking about 1/5 minutes versus manual review's 27 minutes.
Go to primary source ↓e-seedsPDF p. 7, Figure 6 and Cross-Seed Reliability of Generated Jailbreak Prompts
Each generator contributes 1,000 already-successful prompts. At 20 seeds CSR is 82.5% Gemini, 56.4% Claude and 41.2% GPT; initial-success conditioning is explicit.
Go to primary source ↓e-efficiencyPDF p. 7, Table 4 and Efficiency-Coverage Analysis of Dual-Path Verification
For identical 100-prompt settings exhaustive/dual-path totals are 9.15/3.66 hours, 100/21 runs and 23/17 unsafe cases. Discussion attributes missed cases primarily to feedback-driven divergence.
Go to primary source ↓e-appendixPDF p. 5, Appendix A references; p. 7, Conclusion; pp. 8–9, References and document end
Appendix A is cited for experimental details but is absent from the supplied nine-page PDF, which ends with references.
Go to primary source ↓8.5 Primary sources
JailWAM: Jailbreaking World Action Models in Robot Control ↗
PDF · 4,960 extracted words
Source fingerprint
b250b65bfd6e79e73f5d661ae9d716a34e95a7b5de0801699acc769e3133377d