🤖 AI

CIVA: Critic-Induced Value-Subspace Attacks on Visual World-Model Agents

The paper proposes CIVA, a white-box attack method that exploits the low-dimensional value subspace induced by an agent's critic to generate temporally coherent, cost-efficient perturbations that effectively disrupt visual world-model agents like DreamerV3.

Original authors: Jiancheng Wang, Mingli Zhu, Tong Zhang, Jiaqi Ruan, Wei Wang, Siyuan Liang, Dacheng Tao

Published 2026-08-24

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Jiancheng Wang, Mingli Zhu, Tong Zhang, Jiaqi Ruan, Wei Wang, Siyuan Liang, Dacheng Tao

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the rapidly evolving world of artificial intelligence, a new generation of decision-making systems has emerged that learns to act by imagining the future. Unlike older programs that simply react to the image they see at this exact moment, these advanced agents build an internal mental model of their environment. They take a sequence of visual inputs, such as a video feed from a camera, and compress them into a hidden, abstract state that remembers what has happened and predicts what will come next. This internal state allows them to plan several steps ahead, much like a human driver anticipating a curve in the road before they reach it. As these systems move from video games to real-world robotics and safety-critical tasks, understanding how to disrupt them has become a vital question. If an agent relies on a continuous stream of internal predictions, does a small, momentary glitch in the camera feed matter, or does the agent's memory smooth it out? This is the central puzzle researchers are now trying to solve.

A team of scientists has discovered that the way to break these "world-model" agents is not by attacking every single frame of video with random noise, but by finding a specific, hidden direction in the visual data that the agent's own brain is most sensitive to. In a study focusing on agents trained to walk, play ping-pong, and survive in open-ended environments, the researchers found that these systems are surprisingly fragile when attacked in a very specific way. They developed a method called CIVA, which stands for Critic-Induced Value-Subspace Attacks. The core idea is that these agents have a built-in "scorekeeper" that constantly estimates how good their future will be. By studying how this scorekeeper reacts to small changes, the researchers found that the most effective way to lower the agent's score is to push the visual data along a very narrow, low-dimensional path. This path is not random; it is a specific set of directions in the image space that the agent's own internal logic has revealed as critical for its decision-making.

The researchers tested this approach against a sophisticated agent known as DreamerV3, which was trained to perform complex tasks like walking on two legs or playing a game of Pong. They set up a scenario where an attacker could only tweak the current image the agent sees, with a strict limit on how much the pixels could be changed to ensure the disturbance remained invisible to the human eye. Previous attempts to hack such systems often treated each video frame as an independent target, adding noise to every picture in the sequence. However, the researchers found that this approach fails against world-model agents. Because the agent remembers past frames and blends them into its internal state, isolated bursts of noise get washed out and forgotten. The agent's memory acts as a filter, diluting the impact of random, frame-by-frame attacks.

To overcome this, the researchers first ran a series of offline experiments where they probed the agent's internal "scorekeeper" to see which tiny changes in the image caused the biggest drop in the predicted future score. They collected thousands of these effective changes and used a mathematical technique to find the common thread among them. They discovered that all the most damaging changes were concentrated in a tiny, low-dimensional subspace. Imagine a vast, multi-dimensional room where every possible way to change an image is a different direction; the researchers found that the agent's weakness was not spread across the whole room, but was actually confined to a single, narrow hallway within it. Once they identified this hallway, they stopped trying to search the entire room. Instead, they restricted their attacks to move only within this narrow path.

In the final stage of their method, the researchers applied this discovery in real-time. As the agent played, the attacker calculated the best move within that narrow hallway and then smoothed the changes over time. This smoothing was crucial. It ensured that the perturbation did not jitter or flicker from one frame to the next, which would have been easily noticeable and computationally expensive. By keeping the attack steady and aligned with the agent's own internal logic, the researchers were able to consistently trick the agent into making poor decisions. The results were striking. On the walking task, the agent's performance dropped by more than 26 percent, a significantly larger failure rate than any other method tested. On the Pong game, the drop was even more dramatic, with the agent's score falling by nearly 86 percent.

Perhaps most importantly, the researchers showed that their method was not just effective, but also efficient and subtle. Because the attack was confined to a small number of directions, it required far less computing power than previous methods that tried to calculate changes for every single pixel in every frame. The visual changes remained so subtle that they were nearly indistinguishable from the original video to a human observer, yet they completely derailed the agent's ability to function. The study also ruled out the idea that simply making the attack smooth or using random patterns was enough. When they tried using a random set of directions instead of the one found by the agent's own scorekeeper, the attack failed almost entirely. This confirmed that the key to the success was not just the math of the attack, but the fact that it was tailored to the specific internal structure of the victim agent.

The findings suggest that the way we think about attacking intelligent systems needs to change. For agents that rely on memory and internal models, the most dangerous vulnerabilities are not in the individual images they see, but in the specific ways those images are processed over time. The researchers demonstrated that by listening to the agent's own internal signals, one can find a shortcut to its failure. This does not mean these systems are broken, but rather that their strength—using a continuous internal state to make decisions—also creates a unique and narrow point of weakness. As these technologies move closer to real-world deployment, understanding this geometry of failure will be essential for building defenses that can protect them from such targeted, intelligent disruptions. The work serves as a clear reminder that in the world of artificial intelligence, the most effective attacks are often those that understand the mind of the machine better than the machine understands itself.

Technical Summary: CIVA – Critic-Induced Value-Subspace Attacks on Visual World-Model Agents

1. Problem Statement

The paper addresses the vulnerability of Visual World-Model Agents (specifically DreamerV3) to adversarial attacks. Unlike standard reinforcement learning (RL) agents that react to single observations, world-model agents operate through a recurrent latent state, integrating past observations to predict future dynamics.

The authors identify a critical mismatch between existing adversarial attack methods and these agents:

Recurrent Dilution: Standard frame-wise attacks (e.g., Projected Gradient Descent or PGD) apply perturbations independently to each frame. In world-model agents, the recurrent latent state smooths out isolated, high-frequency noise, causing greedy frame-wise attacks to fail in accumulating influence over long horizons.
Computational and Temporal Constraints: Running full-pixel PGD at every frame is computationally expensive and produces temporally jittery perturbations that violate the "stealth" requirement (temporal coherence) needed for realistic attacks under strict per-frame $\ell_\infty$ budgets.
Ineffective Search Space: Effective attack directions do not span the full pixel space uniformly. Instead, the authors observe that critic-guided perturbations concentrate in a surprisingly low-dimensional subspace induced by the victim's own value landscape.

2. Methodology: CIVA

The proposed Critic-Induced Value-Subspace Attacks (CIVA) is a white-box, causal, online attack designed to exploit the recurrent structure of world-model agents. It operates in two stages:

Stage A: Offline Value-Subspace Discovery

Critic-Guided Probing: The attacker performs a clean rollout of the frozen victim agent. Starting after a warm-up period (to stabilize the latent state), it collects pixel perturbations ( $\delta$ ) generated by running multi-step PGD to minimize the critic's predicted value.
Subspace Extraction: The collected perturbations are stacked into a matrix $\Delta$ . A Singular Value Decomposition (SVD) is performed on $\Delta$ to extract the top- $r$ right singular vectors ( $V_r$ ).
Result: This forms a Critic-Induced Value-Subspace ( $S_r$ ), a low-dimensional basis (e.g., $r=32$ in a 12,288-dimensional space) that captures the directions most sensitive to the victim's value function.

Stage B: Online Subspace Attack

Reparameterization: Instead of optimizing in the full pixel space, the attacker optimizes only the coefficients ( $\alpha_t \in \mathbb{R}^r$ ) within the pre-computed subspace: $\delta_t = V_r \alpha_t$ .
Subspace PGD: At each frame, the attacker performs a few gradient steps on the critic-based loss function within the low-dimensional subspace.
Temporal Smoothing (EMA): To ensure temporal coherence and stealth, the subspace coefficients are smoothed using an Exponential Moving Average (EMA): $\alpha_t = \rho \cdot \alpha_{t-1} + (1-\rho) \cdot \alpha^*_t$ . This prevents the "jitter" associated with independent frame-wise attacks while maintaining attack strength because the smoothing occurs within the critic-effective subspace.
Projection: The smoothed coefficients are lifted back to pixel space and projected onto the $\ell_\infty$ budget and valid pixel range.

3. Key Contributions

The paper makes three primary contributions:

Identification of a Mismatch: It highlights that successful attacks on visual world-model agents must shape the victim's internal recurrent representation over time, rather than merely degrading individual frames.
Proposal of CIVA: A novel attack framework that extracts a victim-aware, low-rank perturbation basis offline and performs efficient, temporally coherent online optimization within that subspace.
Empirical Validation: Comprehensive evaluation demonstrating that low-dimensional, critic-aligned perturbations are significantly more effective for world-model agents than direct full-pixel frame-wise optimization.

4. Experimental Results

The authors evaluated CIVA on three benchmarks: DMC Walker Walk (continuous control), Atari Pong (discrete control), and Crafter (open-ended survival), using a frozen DreamerV3 victim.

Attack Effectiveness: CIVA consistently outperformed five recent baselines (MAD, UAP-RL, PA-AD, Illusory, DAPGD).
- On DMC Walker Walk, CIVA achieved a 26.07% reward drop (the largest among all methods) while maintaining a low Temporal Absolute difference (TempAbs) of 0.646.
- On Atari Pong, CIVA achieved an 85.71% reward drop, significantly surpassing the next best method (MAD at 66.67%).
Temporal Coherence & Stealth: CIVA produced perturbations with significantly lower temporal variation (TempAbs) compared to frame-wise baselines (e.g., ~10x improvement over PA-AD on DMC), while maintaining high perceptual similarity (SSIM).
Ablation Studies:
- Replacing the critic-induced subspace with a random basis (V1) or removing the subspace constraint (V2) drastically reduced attack effectiveness, confirming that the specific structure of the critic-induced subspace is crucial.
- Removing the EMA smoothing (V3) slightly increased reward drop but severely degraded temporal coherence, validating the trade-off managed by the EMA.
- Using the reward-head gradient instead of the critic value (V4) resulted in the weakest attack, suggesting that the critic's long-horizon value landscape is the correct adversarial surface.

5. Significance and Claims

The paper claims that CIVA demonstrates that the value landscape of a recurrent world-model agent constitutes a realistic and potent adversarial surface. By aligning perturbations with the critic's sensitivity and enforcing temporal coherence through a low-dimensional subspace, CIVA overcomes the limitations of traditional frame-wise attacks.

The authors position this work as a necessary step toward understanding the security of visual world-model agents before developing defenses. They emphasize that the recurrent latent dynamics of these agents induce a specific geometry of effective perturbations that differs fundamentally from standard supervised learning or frame-local RL attacks. The method is presented as a practical, computationally efficient solution for white-box online attacks under strict resource constraints.