Technical Summary: Attacking the Trusted Imagination

Problem Statement

Recent Vision-Language-Action (VLA) policies increasingly adopt an "imagine-then-act" architecture, where a World-Action Model (WAM) first generates a latent trajectory of future visual representations ($\tilde{z}$) before conditioning the action policy. While prior adversarial research focuses on attacking the reactive policy's observation-to-action pathway, this paper identifies a new, distinct attack surface: the trusted imagination consumed by downstream oracles.

The authors argue that while reactive policies execute in a real closed-loop where environmental feedback corrects errors, downstream oracles (such as safety gates, visual Model-Predictive-Control (MPC) planners, or "imagine-then-check" verifiers) treat the imagined future $\tilde{z}$ as a trusted prediction without real-world corrective signals. Consequently, the robustness of the reactive policy does not imply the robustness of systems relying on the WAM's imagination. The core phenomenon is an asymmetry: corrupting the imagination (pushing it off its natural manifold) is easy, but precisely steering it to a specific target on the manifold is hard.

Methodology

Threat Model

The authors adopt a capability-based, white-box threat model:

• Attacker Capabilities: The attacker has full access to the WAM and encoder (Kerckhoffs's principle) and can perturb the current camera observation $o$ with an $\ell_\infty$-bounded perturbation $\delta$ ($\|\delta\|_\infty \leq \epsilon$).
• Constraints: The attacker cannot modify model weights, access the oracle's internals, or observe the true future.
• Differentiability: The attack leverages the fact that for continuous diffusion-based WAMs, the map from observation to imagined future ($o \to \tilde{z}$) is end-to-end differentiable (no discrete vector quantization or in-place cache writes), enabling true Projected Gradient Descent (PGD).

Attack Objectives

The paper defines two attack objectives (Definition 2):

1. Untargeted Corruption: Maximizes the divergence between the adversarial imagination $\tilde{z}_{adv}$ and the clean imagination $\tilde{z}_{clean}$ by minimizing their cosine similarity. This aims to push $\tilde{z}$ off the natural-future manifold.
2. Targeted Steering: Attempts to drive $\tilde{z}_{adv}$ toward a specific attacker-chosen target $\tilde{z}_{tgt}$ (e.g., a different scene or instruction).

Detection Mechanism

The authors propose a parameter-free denoiser self-consistency detector. Since corrupted imagination is inherently "off-manifold" (deviating from the low-dimensional manifold of natural futures learned by the model), the detector measures the mean future-frame velocity-prediction norm at small noise levels. A high norm indicates the sample is off-manifold and likely corrupted. This detector requires no clean reference.

Key Contributions

1. New Attack Surface: The first white-box integrity attack against the trusted imagination of imagine-then-act WAMs. The authors demonstrate that the observation-to-imagination map allows for true gradient-based attacks on the latent future.
2. Asymmetry Mechanism: The paper establishes that untargeted corruption is significantly easier (approx. 60$\times$ stronger than random noise) and perceptually visible, whereas targeted steering to arbitrary scenes is strictly bounded. This asymmetry is pinned by decoded-frame evidence, not just latent cosine similarity.
3. Robust Defense: A parameter-free denoiser detector achieves an Area Under the Curve (AUC) of 1.0 in distinguishing clean from adversarial imagination. Crucially, the defense holds against adaptive attackers; an attacker attempting to evade detection by staying on the manifold must surrender the ability to corrupt the imagination.
4. Task-Level Null vs. Oracle Failure: The paper provides an "honest null" showing that reactive policies remain robust to corrupted imagination (success rates barely drop). However, it demonstrates the first adversary-specific real task failure in a native imagination-driven MPC, where the oracle's trust in the corrupted $\tilde{z}$ leads to catastrophic decision-making.

Experimental Results

The study evaluates three targets spanning the imagination-to-action coupling: RynnVLA-002 (disconnected coupling), LingBot-VA (weak coupling/oracle), and LaDi-WM (strong native coupling).

• Untargeted Corruption: On LingBot-VA, untargeted attacks achieved up to 60$\times$ the corruption of random noise. At $\epsilon=0.1$, a fidelity verifier flipped to "untrustworthy" in 100% of cases with 0% false positives. Decoded frames showed perceptually visible artifacts (smearing, ghosting).
• Targeted Steering: While latent cosine metrics suggested some steering, decoded frames and verifiers showed that steering to a genuinely different scene was bounded. For cross-scene targets, the gap closed was only ~0.2, and the verifier correctly rejected the adversarial imagination in 0/8 cases.
• Detection: The denoiser self-consistency detector achieved AUC 1.0 at $\epsilon \geq 0.2$. Surface statistics (RMS, max-abs) failed to detect the attack, confirming the attack stays within the $\ell_\infty$ budget while moving off-manifold.
• Adaptive Attackers: When attackers minimized a loss combining corruption and detection score, evasion of detection required a significant reduction in corruption (from 0.279 to 0.064), proving the defense holds.
• Real Task Failure (LaDi-WM MPC): In a sampling MPC setup, adversarial corruption caused a collapse in success rate. At $\epsilon=0.01$, random noise maintained a success rate of ~0.70 (similar to clean), while the adversarial attack dropped success to 0.05 (Fisher $p < 10^{-4}$). This "adversary-specific window" demonstrates that the oracle's reliance on imagination creates a unique vulnerability not present in the reactive policy.

Significance and Claims

The paper claims that policy robustness does not equal system robustness when the system relies on a trusted imagination. The central thesis is that the "trusted imagination" is a critical vulnerability for downstream oracles (planners, verifiers, safety gates) that lack real-world corrective signals.

The significance lies in:

• Identifying that the "imagine-then-act" paradigm introduces a specific attack surface distinct from the action pathway.
• Demonstrating that while reactive policies can tolerate corrupted internal features, systems that act on these features as predictions (oracles) suffer adversary-specific failures.
• Showing that the inherent "off-manifold" nature of corruption allows for highly effective, parameter-free detection, even against adaptive attackers.

The authors explicitly note limitations: the evaluation is simulation-based (LIBERO-10), the targeted steering is bounded (cannot arbitrarily control the scene), and the "availability" impact (task success drop) is statistically significant but modest in magnitude compared to early pilot estimates. The work concludes that the primary threat is the corruption of the oracle's decision-making process, not the arbitrary hijacking of the policy's behavior.