BadWAM: When World-Action Models Dream Right but Act Wrong
1. Paper overview
In one sentence: BadWAM finds observation perturbations that degrade closed-loop control while preserving comparatively similar predicted futures, exposing the limits of imagination as a safety signal. e-identitye-threate-objectivese-maine-main-conflicte-protocole-weight-conflict
| At a glance | What to know |
|---|---|
| Research problem | |
| Core mechanism | Author claim The authors formulate world-action drift through action and imagination distances, with action-only and imagination-preserving objectives sharing one online optimizer. e-objectives |
| A key reported result | Full LIBERO closed-loop manipulation under BadWAM: Action-only WAM: 43.1; joint: 61.5/63.0; IDM: 66.1/68.1 for action-only/preservation attacks. Task success (%). 40 tasks × 20 trials; epsilon 0.06; eight paired updates per replan. Clean: 96.5, 98.1, 98.4 respectively. The first reduction is 53.4 percentage points. Table 1 values; aggregate cells have no uncertainty estimates. Action-only WAM exposes no future for preservation. e-maine-protocole-hyperparameters |
| Reading caution | Reader analysis Internal inconsistencies remain: Section 5.2 gives joint/IDM clean success 96.7/100.0 and IDM preserved success 67.0, versus Table 1’s 98.1/98.4 and 68.1. Transfer prose uses a 96.7 joint reference versus Table 2’s 98.3; some printed drops differ by 0.1 point from rounded-cell subtraction. e-main-conflicte-transfer |
Core contributions
- Author claim
The authors formulate world-action drift through action and imagination distances, with action-only and imagination-preserving objectives sharing one online optimizer. e-objectives
- Source description
The evaluation combines closed-loop success, channel/horizon diagnostics, future drift, transfer, preprocessing and detection across three controller interfaces. e-policiese-rolloutse-transfere-defensee-detector
Figure 3. BadWAM optimizes the visual input around a frozen predictive-action interface. Original paper, p. 5 ↗
Excerpt from the authors’ paper; cropped without altering the figure or table.
How to read it. Read from left to right. The clean observation and language goal establish reference actions and futures. In the center, the attacked query changes the visual input by delta while the frozen marker keeps model parameters fixed. The objective boxes ask for larger action distance and, for preservation, smaller imagination distance. The lower loop samples paired directions, queries outputs, scores candidates and clips updates to the perturbation bound. The right panel separates a predicted path from an executed path. This is a conceptual interface drawing: Section 5.1 separately distinguishes direct-action, joint and IDM controllers, so the shared-state/two-head sketch should not be read as every victim’s exact architecture. e-threate-objectivese-onlinee-policies
What it supports. The attack controls observations and uses output feedback; it does not need to command the action head directly. Equations (8) and (9) give the operative distinction: action-only maximizes action drift, whereas preservation subtracts a future-drift penalty. Both use the same online search structure.
Where the evidence stops. The diagram and caption emphasize preserved futures, but the action-only objective imposes no preservation term. The soft penalty also provides no hard guarantee that a future remains correct or physically realizable.
2. Motivation
2.1 The problem and the proposed response
A future-only monitor can miss changes in the action actually executed. BadWAM asks whether this gap is exploitable under output-query access, distinguishing untargeted task failure from preservation of the model’s clean future prediction. e-framinge-threat
2.2 What this reading follows
A robot can predict a plausible-looking future and still issue an action that fails to realize it. BadWAM probes this possibility by comparing a frozen controller’s outputs on clean and perturbed observations. One objective pushes actions away from their clean reference; another also discourages changes in the imagined future. The important evidence is the combination of actual benchmark task outcomes and output-distance diagnostics. Read this edition in that order: understand the interface, inspect the main success table, then examine what preservation and detection do—and do not—measure. This is the supplied July 2026 v1, including its unresolved numerical inconsistencies and explicitly provisional subset studies. e-identitye-threate-objectivese-maine-main-conflicte-protocole-weight-conflict
3. Research context
We place the paper in the collection through its world–action interface. The catalog labels and the reading’s assessment are shown separately.
| Catalog dimension | Recorded classification |
|---|---|
| Major category | Foundational work |
| Architecture | Not applicable |
| Prediction paradigm | Not applicable |
| Quadrant | Not applicable |
This table preserves the labels recorded at reading time. The current major category is Related resources. View the current classification.
3.1 Evidence-based assessment
Supports the recorded classification
Foundational work / Evaluation metrics & protocols fits an attack framework and diagnostic evaluation. Architecture, prediction paradigm and quadrant remain not applicable to BadWAM itself: its victims include direct, joint and IDM controllers. Figure 3’s generic heads do not establish a new One Model architecture. e-objectivese-policiese-training
This is the collection’s architectural analysis, not a new related-work survey. Benchmark comparisons and their protocols appear in Section 6.
4. Problem formulation
4.1 Inputs and outputs
| Inputs | Outputs |
|---|---|
|
|
4.2 Equations and their role
5. Method in detail
5.1 Separate the victim interface from the adversary’s objective
The three victim interfaces expose different information. The action-only controller maps observations and instructions to action chunks. The joint controller predicts actions and future states together, while IDM constructs a future representation before decoding actions. BadWAM wraps these controllers with queries rather than replacing their architectures. At each replan, the clean query establishes a local reference, and candidate perturbed observations are scored against it. An action-only attacker needs only action outputs; an imagination-preserving attacker also needs the future output. This distinction explains why the preservation cells are absent for the action-only WAM. Training the victim with world prediction does not, by itself, mean that its deployed interface exposes a future for attack optimization or safety inspection. e-framinge-threate-policiese-objectivese-main
Figure 4. Preservation is illustrated by comparing each attacked prediction with its own clean prediction. Original paper, p. 6 ↗
Excerpt from the authors’ paper; cropped without altering the figure or table.
How to read it. Within each three-column block, compare the clean future with the adversarial future on the same row, then inspect the absolute-difference image. Rows select future steps zero, four and seven; the difference images are amplified eightfold by the original paper. The left block omits preservation, while the right includes it. Focus on how object and arm boundaries change within each example rather than comparing the two clean sequences as if they were identical starting states. The caption identifies IDM WAM and states that both examples induce action-space failure. The images themselves show predicted frames, not the complete executed trajectories. e-futurese-objectivese-online
What it supports. The illustration makes the preservation objective concrete: an attacked prediction can remain visually close to its clean reference even when the authors report an action failure. It supports the qualitative possibility of action–future decoupling and motivates measuring execution outcomes separately from prediction similarity.
Where the evidence stops. These are selected examples with different clean reference images, not a controlled estimate of average improvement. Eightfold amplification aids visibility, and similarity to a clean forecast does not validate either forecast against the physical future.
5.2 Understand what the preservation penalty can establish
Equation (7) describes the desired attack as large action deviation subject to a limit on imagination drift. Equation (9) replaces that constraint with a weighted penalty. The practical result depends on lambda, query resources and the scale of the two distances. The appendix’s implementation uses paired output queries and signed projected updates; it does not differentiate through the victim. Reader analysis: this objective encourages a discrepancy between two clean-referenced outputs, but it does not directly test whether the attacked action would realize the predicted future. That stronger causal check would require an execution-consistency measurement. Figures 4 and 12 combine prediction similarity with task failure, supporting a narrower warning about relying on plausible imagination alone. Figure 13 illustrates a trade-off, but its joint-model weight labels conflict with Section 5.5; that exact numerical mapping remains unresolved. e-objectivese-onlinee-hyperparameterse-futurese-stealthe-weighte-safetye-weight-conflict
5.3 Follow local deviations into closed-loop outcomes
BadWAM optimizes a local action-distance surrogate, then the environment supplies feedback through the next observation. The paper’s qualitative rollout and accumulated-shift plots show why the execution loop matters: initially plausible manipulation can drift into failed grasps and displaced objects. Reader analysis: increasing a local score need not monotonically increase final task failure, which is consistent with the nonmonotonic budget sweep. Evaluation scope also matters. The headline LIBERO table covers forty tasks with twenty trials each; preservation-weight, transfer and defense studies use twelve tasks with ten trials each. The paper’s pass@k is a running success fraction, not a best-of-k success probability. Keep these denominators and definitions separate before comparing attack strength, stealth, runtime or defense recovery. e-onlinee-rolloutse-budgete-protocole-metrics
5.4 Training and inference
During training
BadWAM trains no attack network. Victims use FastWAM checkpoints or its unchanged recipe, with Wan2.2-TI2V-5B backbone and Wan2.1-T2V-1.3B tokenizer. Joint/IDM training uses eight H100 GPUs, batch sixteen per GPU, learning rate 0.0001 and cosine scheduling: ten LIBERO epochs or 50,000 RoboTwin steps. e-onlinee-training
LIBERO uses two 224×224 views; RoboTwin three 240×320 views. Both use 33-frame training windows representing 32 action steps and nine video frames. The victim losses and detailed inference sampler are not fully specified here; the paper refers to FastWAM defaults. e-training
During inference
Default attacks use epsilon 0.06, eight paired updates and seventeen reported forward queries per replan, including the clean reference. Radius and step size are 0.02; preservation uses lambda 0.015. Appendix A.3 specifies signed updates, while Eq. (12) displays the estimated gradient without taking its sign. e-hyperparameterse-online
Action/future distances use mean L2 deviation; their ratio includes an unspecified stabilizer. Success is task-averaged. This paper’s pass@k is the average success fraction among the first k trials, not probability of at least one success. e-metrics
5.5 Implementation flow
- Establish a clean reference
Query the current observation and goal for clean actions and, where exposed, predicted futures. Optimization needs no expert action or task-success label. e-objectivese-threat
- Score the perturbation
Maximize clean–attacked action deviation. For imagination-visible models, subtract a weighted future-distance penalty. The conceptual hard drift constraint becomes a soft objective; preservation is not guaranteed. e-objectives
- Search through outputs
Probe positive and negative perturbations, estimate an objective direction, project updates into the visual bound and retain the best candidate. Victim parameters remain frozen. e-onlinee-hyperparameters
- Execute and observe again
Obtain actions from the perturbed observation, execute part of the chunk, and optimize again after feedback. Action-only predicts actions directly; joint predicts futures/actions together; IDM decodes actions after constructing a future representation. e-onlinee-policies
6. Experiments & results
BadWAM tests whether bounded visual perturbations can separate a world-action model’s actions from its predicted future. It optimizes action deviation through queries, optionally penalizing future drift, then evaluates closed-loop control. LIBERO shows substantial reliability loss; closeness to clean imagination remains a limited proxy for stealth.
Figure 13 contains overlapping weight-axis tick labels and a joint-model weight/distance assignment that conflicts with Section 5.5. Its readable point annotations expose the contradiction, but do not resolve the disputed numerical mapping. The base report retains the prose-reported weight-ablation result with this qualification. Figure 13 is covered by the inspected source page and tutorial discussion; the six selected crops use the legible baseline comparison and matched-resource diagnostic to illustrate related experimental evidence. e-weighte-weight-conflicte-baselinese-stealth
6.1 Read the original evidence
Table 1. Closed-loop reliability drops on both benchmarks, with a much larger effect on LIBERO. Original paper, p. 7 ↗
Excerpt from the authors’ paper; cropped without altering the figure or table.
How to read it. Each row identifies the victim controller; the columns inside each benchmark distinguish clean evaluation from the two attack objectives. All main values are task success percentages, so lower attacked values mean stronger disruption. The small gray parenthetical values are absolute success reductions, interpreted as percentage points. A dash for the action-only WAM means preservation is inapplicable because its future is not exposed. The caption fixes epsilon at 0.06 and eight optimization iterations per replan. Appendix A.1 supplies the full LIBERO denominator: forty tasks with twenty trials each. RoboTwin is described as a full protocol without corresponding task and trial counts. e-maine-main-conflicte-protocole-hyperparameters
What it supports. For the action-only WAM, LIBERO success falls from 96.5% to 43.1%, a 53.4-point decrease. The joint and IDM preserved-attack values are 63.0% and 68.1%. RoboTwin decreases are only 5.7–7.7 points across the reported attacks, so the severity is benchmark dependent.
Where the evidence stops. Section 5.2 instead gives joint/IDM clean values 96.7/100.0 and IDM preserved success 67.0; this edition attributes the displayed numbers to Table 1. No uncertainty accompanies its aggregate cells, and the later subset studies use different evaluation runs.
Figure 6. Output-guided attacks reduce task success more than random noise; the gradient-access reference is stronger still. Original paper, p. 7 ↗
Excerpt from the authors’ paper; cropped without altering the figure or table.
How to read it. Read each row horizontally, keeping the victim controller fixed. Gray circles mark random perturbations, red squares action-only BadWAM, teal diamonds imagination-preserving BadWAM, and purple crosses the white-box reference. The horizontal axis is task success under attack, so movement to the left means greater disruption. The caption matches the infinity-norm perturbation bound, while Table 4 places this comparison on the full LIBERO sweep. Appendix A.5 describes independent uniform noise at each observation. Appendix A.4 instead optimizes the white-box perturbation at episode start using gradients. BadWAM searches through output queries at successive replans. These protocol differences matter when interpreting the spacing between markers. e-baselinese-maine-protocole-online
What it supports. For joint WAM, random noise leaves 71.0% success, compared with 61.5% and 63.0% for the two BadWAM objectives. IDM shows the same ordering: 75.2%, 66.1% and 68.1%. The white-box values, 49.2% and 52.8%, show stronger disruption under the different gradient-access reference protocol.
Where the evidence stops. Matching the visual bound does not match adversarial access or optimization timing. The white-box reference is an empirical comparison, not a certified worst-case bound. No uncertainty is displayed, and these success values alone do not measure whether imagined futures were preserved.
Figure 15. Moderate overall discrimination leaves low detection recall at the marked operating point. Original paper, p. 13 ↗
Excerpt from the authors’ paper; cropped without altering the figure or table.
How to read it. The left panel shows the full receiver operating characteristic: horizontal position is false-positive rate and vertical position is true-positive rate. Joint WAM is red, IDM is teal, and the dashed diagonal is random discrimination. The right panel uses logarithmic axes to expose behavior at low false-positive rates; the marked points correspond to five percent FPR. Read those labels separately from the overall AUC values in the left legend. Section 5.7 describes the detector as checking output inconsistency under a JPEG-augmented view. These are detections of attacked replans in the balanced LIBERO subset, not counts of prevented failed episodes. e-detectore-defensee-protocol
What it supports. AUROC is 0.675 for joint and 0.725 for IDM, but TPR at five percent FPR is only 13.4% and 21.4%. The operating-point evidence is therefore weaker than the full-curve impression might suggest: most attacked replans remain undetected at that threshold.
Where the evidence stops. This tests one augmentation-consistency detector, not all future-based monitors. Its recall cannot be converted into a probability of preventing robot failure without a specified intervention policy and episode-level evaluation.
6.2 Results and evaluation conditions
| Task & protocol | Reported result | Comparison & interpretation |
|---|---|---|
| Full LIBERO closed-loop manipulation under BadWAM 40 tasks × 20 trials; epsilon 0.06; eight paired updates per replan. | Action-only WAM: 43.1; joint: 61.5/63.0; IDM: 66.1/68.1 for action-only/preservation attacks. Task success (%) | Clean: 96.5, 98.1, 98.4 respectively. The first reduction is 53.4 percentage points. Table 1 values; aggregate cells have no uncertainty estimates. Action-only WAM exposes no future for preservation. e-maine-protocole-hyperparameters |
| Full RoboTwin closed-loop manipulation under BadWAM Reported full RoboTwin protocol; epsilon 0.06, eight updates; joint/IDM trained 50,000 steps. | Action-only WAM: 84.4; joint: 84.4/85.2; IDM: 83.7/85.1 for action-only/preservation attacks. Task success (%) | Clean: 92.1, 90.9, 91.4 respectively; reductions span 5.7–7.7 percentage points. Effects are smaller than on LIBERO; task/trial counts for this full protocol are unspecified. e-maine-traininge-protocol |
| Targeted versus random and white-box perturbations Full LIBERO; joint/IDM; same infinity-norm bound. | Random: 71.0/75.2; white-box reference: 49.2/52.8. Task success (%) | BadWAM action-only: 61.5/66.1. Optimization improves disruption over noise. White-box access and episode-start optimization differ from BadWAM; this is no formal worst-case bound. e-baselinese-main |
| Future-preserving weight ablation Balanced LIBERO subset, 120 episodes per model–attack pair; Section 5.5 compares lambda 0 with 0.015. | Section 5.5 reports joint success 61.7→56.7% and future distance 14.70→14.34; IDM success 55.0→51.7% and distance 15.36→15.13. The joint distance/weight assignment conflicts with Figure 13. Task success (%) and predicted-future distance | The prose reports simultaneous decreases at lambda 0.015; the plotted sweep shows a nonmonotonic trade-off. Retained as a prose-reported subset result. Figure 13 labels the joint point near distance 14.34 as lambda 0.005 and places 0.015 near 14.7, so the exact joint preservation gain at 0.015 is unresolved. e-weighte-weight-conflicte-protocol |
| Cross-variant imagination-preserving transfer Balanced LIBERO subset; source-optimized perturbations, target closed-loop evaluation. | Joint→IDM: 60.8; IDM→joint: 63.3. Target task success (%) | Table 2 target clean references: 100.0 and 98.3. Transfer among related variants; reported future distances describe the source, not target preservation. e-transfere-protocol |
| Non-adaptive defenses and consistency detection Balanced LIBERO subset; imagination-preserving attack; joint/IDM. | JPEG-noise: 94.2/89.2 and 93.3/90.0. Detector TPR at 5% FPR: 13.4%/21.4%. Clean/attacked task success (%) and detector TPR | Without preprocessing: 98.3/57.1 and 100.0/54.6 clean/attacked success. Preprocessing recovers control against this non-adaptive attack, but the detector misses most attacked replans. e-defensee-detectore-protocol |
6.3 Ablations and diagnostic examples
Read component removals and qualitative examples within their stated evaluation conditions.
Figure 12. A separate matched-resource run trades some disruption for a lower predicted-future distance. Original paper, p. 11 ↗
Excerpt from the authors’ paper; cropped without altering the figure or table.
How to read it. Start with the success bars: 61.5% for action-only and 65.9% for preservation are comparable, but not identical, attack outcomes. Then follow the red and teal traces across optimization iterations. The future-distance panel shows preservation keeping the output closer to its clean prediction, while the final panel tracks input L1 magnitude under the shared infinity-norm budget. The middle-right ratio panel is a diagnostic, not a calibrated safety score. Shaded bands are 95% confidence intervals over replans. Appendix A.3 says this experiment uses a larger preservation weight than the default; Table 4 places it on full LIBERO for one selected variant. e-stealthe-metricse-protocole-hyperparameters
What it supports. Within this displayed run, reduced future drift coexists with substantial task failure. Resource matching helps isolate what adding a preservation term changes, but the observed success rises by 4.4 percentage points, so the visual does not establish exactly equal attack strength or a universally better trade-off.
Where the evidence stops. The selected variant and larger lambda are unspecified. Section 5.4’s averages 14.01/13.04 are not reconciled with these plotted future-distance traces. They should not be presented as values read from this panel or merged with Table 1.
7. Analysis & limitations
7.1 What the evidence leaves open
Internal inconsistencies remain: Section 5.2 gives joint/IDM clean success 96.7/100.0 and IDM preserved success 67.0, versus Table 1’s 98.1/98.4 and 68.1. Transfer prose uses a 96.7 joint reference versus Table 2’s 98.3; some printed drops differ by 0.1 point from rounded-cell subtraction. e-main-conflicte-transfer
Figure 12’s 61.5/65.9 comparison is a separate matched-resource run with an unspecified larger lambda and selected variant. Its future-distance trace and the text’s means 14.01/13.04 have no explained aggregation link; retain the qualitative trend without equating these numbers. e-stealth
Section 5.5 and Figure 13 conflict: joint future distance 14.34 is assigned to lambda 0.015 in prose but to 0.005 in the plot; the plotted 0.015 point is near 14.7. The prose result remains recorded with this unresolved mapping. Overlapping baseline ticks in the original right panel are not inferred. e-weighte-weight-conflict
Closeness to a clean prediction establishes neither physical correctness nor bypass of every future-based monitor. Physical deployment is untested, and defenses are non-adaptive. Figure 2’s large gripper shifts also caution against a continuous-channel-only explanation. e-objectivese-futurese-safetye-defensee-channels
The authors identify logging-heavy runtime costs and plan full reruns of subset studies. More search increases cost without monotonically worsening success; prototype timings do not establish real-time feasibility. e-budgete-protocol
7.2 Questions for discussion
- Would an executed-action consistency monitor remain sensitive when future-only distance is small?
- Does the preservation trade-off persist across paired seeds and full-benchmark reruns?
8. Reproducibility audit
8.1 Requirements and known gaps
Preserve victim checkpoint, preprocessing and task split. Resolve missing RoboTwin task/trial counts, seeds, normalization and tensor-distance reductions, executed chunk length, matched-run lambda/model, ablation budget units, and the Figure 13 weight/distance discrepancy. Distinguish eight paired updates from sixteen perturbation queries and account for any final execution query. e-traininge-protocole-metricse-stealthe-hyperparameterse-budgete-weight-conflict
Reader-proposed checks: compare preservation weights on paired seeds with identical query resources, then test JPEG preprocessing against fixed and transformation-aware attacks. Measure execution success alongside future distance; the illustrated edition specifies controls and falsifiable outcomes. e-weighte-defensee-protocole-weight-conflict
8.2 Proposed reproduction checks
The following checks are proposals motivated by the paper. They have not been run as part of this reading.
Check 1: Test preservation with paired trials and explicit query accounting
Reader-proposed, not performed: use both future-visible controllers on task IDs 0, 4 and 9 in each LIBERO suite with ten paired trials per task. Compare clean input, uniform noise and lambda 0, 0.005 and 0.015 at epsilon 0.06, keeping checkpoints, initial states, sampler randomness, distance reductions and eight paired updates fixed. Include 0.005 to investigate Figure 13’s conflict with Section 5.5. Save weight-tagged success and distance measurements together. Count sixteen perturbation queries, the clean query and any execution query separately. Preservation is supported if paired trials reproducibly reduce future drift while retaining comparable failures; disappearance of that benefit would weaken the mechanism claim. Fresh measurements would not establish which original label was mistaken. e-protocole-hyperparameterse-metricse-baselinese-weighte-weight-conflict
Check 2: Distinguish preprocessing recovery from adaptive robustness
Reader-proposed, not performed: on the same documented LIBERO subset, compare no preprocessing and a fully specified JPEG-noise ensemble under clean input, the original non-adaptive attack and an attack scored through the same randomized preprocessing. Count every transformed victim forward call and match total query resources and epsilon, rather than matching nominal iterations alone. Track clean and attacked task success plus detector TPR at a threshold fixed on separate clean calibration trials. If JPEG recovery collapses under the transformation-aware comparison while clean success stays high, the original improvement reflects non-adaptivity. Retained recovery across paired trials would support a stronger, still budget-specific robustness claim. e-defensee-detectore-protocole-hyperparameters
8.3 Reading coverage
Visual audit: All seven supplied text chunks were read individually, including references and Appendix A.1–A.6. Visually inspected the title/author/version block on page 1, framing and threat details on pages 2–4, all Figures 1–15 and Tables 1–5, method/evaluation evidence on pages 5–14, and appendix protocols, training hardware/configuration and metric definitions on pages 16–17. All six selected original crops were inspected: Figures 3, 4, 6, 12 and 15, and Table 1. Figure 6 retains its complete legend, both controller rows, all labeled results and the success axis. Its interpretation also uses the visually inspected baseline discussion on page 9, episode-start white-box protocol on page 16, and full-sweep/random-noise details on page 17. Figure 3’s optimization directions and frozen/input markers were checked against Eqs. (6)–(12); its two-head layout is conceptual, and preservation is not attributed to the action-only objective. Disclosed source conflicts include Table 1 versus Section 5.2, transfer clean references, Eq. (12) versus appendix signed updates, Figure 12’s unexplained aggregates, and Figure 13’s joint weight/distance labels versus Section 5.5. Figure 13 was inspected on page 11; its overlapping weight-axis ticks prevent reliable independent reading, so Figure 6 replaces it among the selected crops. The weight-ablation result, its unresolved mapping and supporting page 11 remain included. Page 15 contains references and was read as text only. No external resources or supplemental material were inspected and no experiments were executed.
PDF pages inspected for this edition: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17. Appendix coverage: reviewed.
Original figures and tables remain the work of the source’s authors. Extractions preserve their scientific content; any HTML wrapper layout is disclosed with each figure. The surrounding reading notes are our own.
Text reading scope & known omissions
- Title, authors, Abstract and arXiv v1 stamp
- 1 Introduction
- 2 Related Work (2.1–2.2)
- 3 Threat Model
- 4 BadWAM (4.1–4.5)
- 5 Evaluation (5.1–5.9)
- 6 Conclusion
- References
- Appendix A.1–A.6; Tables 4–5
Outside the original text pass
- Text extraction does not reconstruct figure images; inspect the retained PDF for figures and equation/table layout.
- Version scope: arXiv:2607.15207v1, 16 July 2026. Title and all three authors match the catalog. No other revision was supplied or compared; Table 4 describes planned updates, not observed later results.
- Text extraction does not reconstruct figure images; inspect the retained PDF for figures and equation/table layout. This limitation was addressed by visually inspecting all supplied figures, tables and claim-supporting pages.
- Separate supplemental material availability has not been fully verified.
- No external code, checkpoints, referenced papers or project resources were inspected. No experiments were reproduced. Reference-only page 15 was read in text but not rendered.
The visual audit above records the subsequent illustrated pass.
8.4 Traceable evidence
e-identityPDF p. 1, title/author block and arXiv margin stamp
Exact observed title: BadWAM: When World-Action Models Dream Right but Act Wrong. Qi Li and Xinchao Wang are affiliated with National University of Singapore; Xingyi Yang with The Hong Kong Polytechnic University. Wang is corresponding author. The stamp reads arXiv:2607.15207v1, 16 July 2026.
Go to primary source ↓e-framingPDF pp. 1–3, Abstract, Sections 1–2.2 and Eqs. (1)–(4)
The paper distinguishes reactive, joint and imagine-then-act prediction, and future prediction used as training supervision. It motivates action–imagination alignment because future-only monitoring need not observe executed-action changes. H and K index action and future horizons.
Go to primary source ↓e-threatPDF p. 4, Section 3, Eq. (6), capabilities and non-goals
Bounded perturbations affect concatenated visual observations, leaving language, state, dynamics, weights and training data unchanged. Action-only access exposes action chunks; imagination-visible access additionally exposes latent/decoded futures. The goal is untargeted closed-loop task failure.
Go to primary source ↓e-objectivesPDF p. 5, Figure 3, Sections 4.1–4.3, Eqs. (7)–(10)
A constrained action-deviation objective is relaxed to action distance minus lambda times future distance; lambda zero gives the action-only attack. References are clean model outputs, without expert actions or success labels. Figure 3 depicts a frozen queryable interface and online input optimization.
Go to primary source ↓e-onlinePDF p. 6, Sections 4.4–4.5, Eqs. (11)–(12)
Paired finite differences estimate an objective gradient. Eq. (12) projects an update using that estimate without a sign operator. The best perturbation produces actions for closed-loop execution; optimization repeats at each replan. No attack network is trained.
Go to primary source ↓e-futuresPDF p. 6, Figure 4, caption and Qualitative Example
IDM predicted futures at selected steps appear with and without preservation; each has clean, adversarial and absolute-difference columns. Difference images are amplified 8×. The caption reports action-space failure in both examples and closer predictions with preservation.
Go to primary source ↓e-policiesPDF p. 7, Section 5.1, Benchmarks and WAM policies
LIBERO and RoboTwin evaluate action-only, joint and IDM WAM variants derived from FastWAM. Joint predicts actions/futures jointly; IDM decodes actions after constructing a future representation. Preservation applies to the two future-visible interfaces.
Go to primary source ↓e-protocolPDF p. 16, Appendix A.1; PDF p. 17, Table 4, all rows
Full LIBERO uses four suites × ten tasks × twenty trials, totaling 800 episodes per model–attack pair. Subset studies use IDs 0, 4, 9 in each suite and ten trials, totaling 120. Ablations, transfer and defenses/detection are subset studies. Matched strength uses full LIBERO for one selected variant. Full reruns and a different RoboTwin training schedule are planned.
Go to primary source ↓e-trainingPDF p. 16, Appendix A.2; PDF p. 17, Table 5
FastWAM checkpoints/default training are used without architecture changes. Backbone/tokenizer are Wan2.2-TI2V-5B/Wan2.1-T2V-1.3B. LIBERO uses two 224×224 cameras; RoboTwin three 240×320 cameras. Windows cover 33 frames, 32 action steps and nine video frames. Settings include eight H100s, batch sixteen per GPU, learning rate 0.0001, cosine schedule, ten LIBERO epochs or 50,000 RoboTwin steps. Loss/sampler details are not fully restated.
Go to primary source ↓e-hyperparametersPDF p. 16, Appendix A.3
Epsilon 0.06 applies to preprocessed visual input. Eight paired updates use one Rademacher direction each, sixteen perturbation queries plus one clean reference, radius/step size 0.02 and signed projected steps. Default lambda is 0.015; Figure 12 uses an unspecified larger value.
Go to primary source ↓e-metricsPDF p. 8, Metrics and Eq. (13); PDF p. 17, Appendix A.6
Success averages episodes within tasks, then tasks. Action distance is mean L2 deviation; future distance uses an analogous representation/tensor measure. Decoupling divides action distance by future distance plus an unspecified small constant. pass@k is successful fraction among first k trials, averaged across tasks.
Go to primary source ↓e-mainPDF p. 7, Table 1, all rows and benchmark groups
LIBERO clean/action-only/preservation success (%): action-only WAM 96.5/43.1/–; joint 98.1/61.5/63.0; IDM 98.4/66.1/68.1. RoboTwin: 92.1/84.4/–, 90.9/84.4/85.2, 91.4/83.7/85.1. Caption specifies epsilon 0.06 and eight optimization iterations. Gray decreases are absolute reductions.
Go to primary source ↓e-main-conflictPDF p. 8, Section 5.2 opening paragraph, versus PDF p. 7, Table 1
Prose joint/IDM clean values 96.7/100.0 and IDM preservation value 67.0 disagree with Table 1 values 98.1/98.4 and 68.1. The revision does not reconcile them.
Go to primary source ↓e-baselinesPDF p. 7, Figure 6; PDF p. 9, sanity-check discussion; PDF p. 16, A.4; PDF p. 17, A.5 and Table 4
Full-LIBERO joint/IDM success is 71.0/75.2 under random noise and 49.2/52.8 under white-box reference. Uniform noise is independently sampled per observation. White-box optimization at episode start uses sixteen gradient steps of 0.01; access/timing differ from online BadWAM.
Go to primary source ↓e-channelsPDF p. 4, Figures 1–2; PDF p. 2, diagnostic summary; PDF p. 5, Section 4.2 continuation
Failed episodes show larger action distances with overlapping future distances. Channel/horizon shifts vary across models. Figure 2 gripper bars have the largest mean absolute shifts; the introduction emphasizes continuous/later channels while Section 4.2 also names gripper commands.
Go to primary source ↓e-rolloutsPDF p. 8, Figures 7–8; PDF p. 9, Figure 9 and Section 5.3; PDF p. 10, Figures 10–11 and Section 5.4
Suite-level performance varies and repeated-trial averages stay degraded. Figure 9 illustrates progressive execution failure. Figure 10 shows accumulating action shifts, larger for failures, with 95% confidence bands. Figure 11 uses separately zoomed axes and intervals across replans.
Go to primary source ↓e-stealthPDF p. 10, Section 5.4; PDF p. 11, Figure 12; PDF p. 16, A.3; PDF p. 17, Table 4
Matched-resource Figure 12 reports success 61.5% versus 65.9% and smaller future-distance traces with preservation; bands are 95% intervals over replans. Prose means are 14.01/13.04 with improvement on 39 of 40 tasks, but their aggregation relative to the higher plotted trace is unexplained. Selected variant/larger lambda are not identified explicitly.
Go to primary source ↓e-weightPDF p. 11, Section 5.5, first paragraph; PDF p. 17, Table 4, weight-ablation row
Section 5.5 reports subset lambda 0→0.015: joint future distance 14.70→14.34 and success 61.7→56.7%; IDM distance 15.36→15.13 and success 55.0→51.7%. These are prose-reported values, not a reconciled reading of Figure 13. Table 4 identifies the balanced LIBERO subset.
Go to primary source ↓e-weight-conflictPDF p. 11, Figure 13, orange joint-WAM point labels in the left panel and baseline x-axis ticks in the right panel, versus Section 5.5 first paragraph
Section 5.5 assigns joint future distance 14.34 to lambda 0.015. Figure 13 instead labels the orange point near distance 14.34 as 0.005 and places the orange 0.015 point near 14.7. The source does not reconcile this mapping. The right panel has overlapping zero and 10^-3 baseline tick labels; no obscured tick content is inferred. Visible curves show nonmonotonic success as weight changes and no uncertainty bands.
Go to primary source ↓e-budgetPDF p. 11, Section 5.5; PDF p. 12, Figure 14; PDF p. 17, Table 4
Subset success decreases with larger epsilon. Budget B is labeled query budget; costs rise but success is nonmonotonic. Budget 32 is weaker than 16. Text reports per-replan times 2.54→27.84 seconds for joint and 2.71→30.57 for IDM over budgets 1→32, described as logging-heavy prototype costs.
Go to primary source ↓e-transferPDF p. 13, Table 2, all rows and dagger note; PDF p. 12, Section 5.6
Subset action-only transfer success is 64.2, 59.2 and 61.7%. Preservation transfer joint→IDM/IDM→joint gives 60.8/63.3%, clean 100.0/98.3, source future distances 14.86/14.32. Prose instead uses joint clean 96.7. Printed drops 34.2/36.7 differ by 0.1 from rounded-cell subtraction.
Go to primary source ↓e-defensePDF p. 12, Section 5.7; PDF p. 13, Table 3 and dagger note
JPEG-noise clean/attacked task success is 94.2/89.2 for joint and 93.3/90.0 for IDM; no defense gives 98.3/57.1 and 100.0/54.6. Blur also improves attacked control; resize-crop harms clean and attacked control. Attack success in the table means task success under attack. Tests are explicitly non-adaptive.
Go to primary source ↓e-detectorPDF p. 12, Section 5.7; PDF p. 13, Figure 15 legends; PDF p. 17, Table 4
JPEG augmentation-consistency detection has AUROC 0.675/0.725 for joint/IDM and TPR 13.4%/21.4% at 5% FPR. Linear/log ROC panels show the same balanced-subset detection setting; detections are measured over attacked replans.
Go to primary source ↓e-safetyPDF pp. 12–14, Sections 5.8–5.9 and 6
Authors recommend measuring action–imagination synchronization as well as success, distances and failure distributions. The reported benchmark evaluation does not demonstrate physical attack deployment or establish a general safety guarantee.
Go to primary source ↓8.5 Primary sources
BadWAM: When World-Action Models Dream Right but Act Wrong ↗
PDF · 11,264 extracted words
Source fingerprint
23d7d8083a28139b6e95055de37e54f3ffe53ec02b4e2631e799ec9b8c9b56cc