Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

World-action models can be made to imagine a plausible future while executing actions that fail the task, using only small visual perturbations and black-box queries.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 23:50 UTC pith:JS7KXLHQ

load-bearing objection Real vulnerability, conditionally proven: action-imagination decoupling is demonstrated, but the stealthiness claim rests on a pixel-level metric and a few numbers don't reconcile. the 5 major comments →

arxiv 2607.15207 v1 pith:JS7KXLHQ submitted 2026-07-16 cs.LG cs.RO

BadWAM: When World-Action Models Dream Right but Act Wrong

Qi Li , Xingyi Yang , Xinchao Wang This is my paper
classification cs.LG cs.RO
keywords world-action modelsadversarial attacksrobotic manipulationclosed-loop evaluationfuture predictionsafety monitorsblack-box optimizationaction-imagination desynchronization
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper claims that the coupling between future prediction and action generation in world-action models is not a safety guarantee: an attacker can break the alignment between what the model imagines and what it executes. Using bounded visual perturbations found by black-box query-based search, the authors reduce closed-loop task success substantially across several WAM variants, in one case from 96.5% to 43.1%. A second, stealthier attack variant keeps the predicted future close to clean rollouts while still inducing failure, showing that a robot can appear to 'dream right' while acting wrong. The paper argues that safety mechanisms that only check the plausibility of imagined futures are therefore incomplete; the security-critical quantity is the synchronization between imagined future and executed action.

Core claim

BadWAM establishes that the coupling between future imagination and action generation in world-action models is not a safety guarantee: a bounded ℓ∞ visual perturbation, found by black-box zeroth-order search, can shift the action output enough to cause task failure while leaving the predicted future close to the clean rollouts. In the strongest instance, closed-loop success on one WAM variant falls from 96.5% to 43.1%. The imagination-preserving variant shows that even when the action-only objective is constrained by a future-drift penalty, attack strength remains close to the unconstrained case, exposing a WAM-specific failure mode: the robot appears to imagine a plausible future but execu

What carries the argument

The central object is the World-Action Drift Attack, targeting the interface between a WAM's imagination output (predicted future frames or latents) and its action output (the action chunk). BadWAM defines two interface distances — action distance and imagination drift — and optimizes a bounded perturbation to maximize the former while optionally penalizing the latter, using zeroth-order finite-difference queries so the attack needs only black-box access. The imagination-preserving objective uses a Lagrangian trade-off parameter λ; the framework's claim is that this target — the action-imagination alignment — is the security-critical quantity for WAMs.

Load-bearing premise

The attack's stealthiness is measured by how close the attacked predicted frames are to clean predicted frames in pixel or latent distance; if a deployed safety monitor checks semantic task consistency instead of pixel similarity, the 'plausible imagination' premise may not hold.

What would settle it

Equip a WAM monitor that scores the imagined future by task-relevant semantics (object positions, goal progress, or whether the imagined rollout completes the instruction) and run the imagination-preserving attack against it. If this monitor flags the majority of attacked replans at a low false-positive rate while the attack still lowers success, the desynchronization claim would lose its stealth premise; if the monitor stays blind, the stealth premise holds.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Future-prediction-based safety monitors should not treat visual plausibility of imagined futures as sufficient; they need to verify that the executed action would actually realize that future.
  • WAM coupling does not by itself confer adversarial robustness; benchmark-level success drops of roughly 30–50 percentage points occur across WAM variants under bounded perturbations.
  • The attack transfers across WAM variants, suggesting shared observation-space directions that affect action generation, so fixes must target the action–imagination alignment rather than a single model.
  • Preprocessing defenses such as blur and JPEG ensembles weaken the non-adaptive attack but are incomplete, and augmentation-consistency detection misses most attacks at low false-positive rates.
  • Failures are systematic on spatial and long-horizon tasks where small action deviations compound, implying that closed-loop evaluation is needed to expose the vulnerability.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the same desynchronization extends beyond WAMs to other predictive-action models, then any policy using a future-prediction head as a verification interface inherits this risk; testing this on video-language-action models would be a natural next experiment.
  • The paper's stealth metric is pixel-level; a semantic monitor checking object states or task progress might detect the attack, and an adaptive adversary could instead constrain semantic consistency while changing low-level actions — a testable extension.
  • The claim that failures accumulate over the horizon suggests that step-wise action-distance objectives may understate attack risk; a monitor that checks consistency between consecutive imagined and executed trajectories could be a stronger signal than frame-level distance.
  • The non-monotonic query-budget results hint that local per-replan objectives are imperfect proxies for closed-loop outcomes; attack evaluation may need episode-level objectives.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper introduces BadWAM, a black-box adversarial attack framework targeting world-action models (WAMs). It defines two attack objectives: an action-only attack that maximizes clean–attacked action deviation, and an imagination-preserving attack that additionally penalizes drift in the predicted future (Eq. 9, Eq. 10). Both attacks are optimized with zeroth-order finite-difference queries at each replanning step under an ℓ∞ bound. The paper evaluates on LIBERO and RoboTwin across three WAM variants, reporting large closed-loop success drops (e.g., 96.5% to 43.1%) and claiming that actions can be desynchronized from an imagination that remains visually plausible. It further reports ablations, transferability, and non-adaptive defenses.

Significance. If the central claims hold, the paper identifies a genuinely new and safety-relevant failure mode: future prediction in WAMs is not automatically a reliable security/safety signal because action and imagination can be adversarially desynchronized. The work is methodologically useful: it provides a concrete black-box attack recipe, closed-loop evaluation, matched-strength comparisons, and a suite of diagnostic metrics (action distance, future distance, decoupling score). The full-sweep closed-loop results in Table 1 and the white-box/random baselines in Figure 6 are strong evidence that the observed failures are not generic image corruption or optimizer artifacts. However, several auxiliary results that support the WAM-specific stealthiness and transfer claims are currently preliminary or inconsistent, so the paper's central conceptual claim is not yet fully established.

major comments (5)
  1. [§5.2 vs. Table 1] The text reports clean joint/IDM WAM success as 96.7%/100.0% and imagination-preserving IDM success as 67.0%, while Table 1 lists 98.1%/98.4% and 68.1%. These are not rounding differences; they change every reported drop in Section 5.2. The discrepancy must be resolved, and the reader must know which numbers correspond to the full sweep and which to a subset or a different evaluation protocol.
  2. [Appendix A.1, Table 4] Several load-bearing results — the λ ablation (Fig. 13), budget ablations (Fig. 14), transferability (Table 2), and defenses (Table 3) — are reported on a 12-task balanced subset and are explicitly stated as 'planned to rerun' on the full sweep. As written, the paper presents these as completed conclusions for RQ5 and RQ6. This is not acceptable for the claims about transferability and defense effectiveness; either these experiments must be run on the full sweep before publication, or the findings must be re-labeled as preliminary with appropriate caveats in the main text.
  3. [§4.3, Eq. (10)] The core claim that a WAM can 'dream right but act wrong' is operationalized through Dimg, an average frame-level (or latent) distance between clean and attacked predicted futures. The paper does not validate that this distance tracks what a real future-safety monitor would check: semantic object state, task progress, temporal consistency, or action–future agreement. In particular, if the model decodes videos from latent states, a small rendered-frame Dimg can hide large latent drift, so the reported 'preserved imagination' may be a decoder artifact. A concrete test is needed: report the analogous latent-space Dimg for the imagination-preserving attacks, or evaluate a downstream semantic/task-level monitor on the preserved futures. Without this, the stealthiness conclusion remains conditional.
  4. [§5.4, Figure 12] The matched-strength comparison is the central evidence for the stealthier failure mode, but the numbers do not align with Table 1. Figure 12 shows imagination-preserving success of 65.9% for the same condition that Table 1 reports as 63.0% (joint WAM, full LIBERO). If Figure 12 uses a different variant or subset, the caption and text must say so explicitly. Moreover, because the imagination-preserving objective directly minimizes Dimg, lower Dimg under matched strength is partly by construction; the non-trivial part — that task success remains comparable — needs to be established with fully matched configurations and reported without ambiguity.
  5. [§5.7, Table 3] The defense results are presented as showing that 'Gaussian blur and JPEG-noise ensembles recover much of the attacked success,' with clean success preserved. However, these are non-adaptive defenses on the 12-task subset, and the detection result in Figure 15 reports AUROC 0.675–0.725 with TPR at 5% FPR below 22%. The text later concedes that 'simple consistency detection is also insufficient.' The main text should not overstate the preprocessing result without acknowledging that an adaptive attacker or a different subset may change the picture; as currently written, the conclusion that defenses recover 'much of the attacked success' is too strong given the stated scope.
minor comments (5)
  1. [Throughout] The paper inconsistently writes 'W AM' with spaces (e.g., Abstract, Section 2), and uses 'RobotWin' in Table 1 while the benchmark is called 'RoboTwin' elsewhere. Please standardize.
  2. [§5.1] The query accounting is ambiguous: Section 5.1 says 8 optimization iterations with a clean reference give 17 queries, while Appendix A.3 says '16 perturbation queries plus one clean reference.' Clarify the mapping between iterations and forward queries.
  3. [§5.2] Figure 6 caption says 'full LIBERO dataset' while Table 1 is also full; the clean success values differ from Figure 8? For example, Figure 8 clean action-only WAM Spatial is 96.5% whereas Table 1's aggregate is 96.5%; that is consistent, but figure captions should state the exact evaluation protocol to avoid ambiguity.
  4. [§5.3, Figure 8] The suite-level clean numbers (e.g., 96.5% Spatial, 97.0% Goal, 92.5% Long-horizon) are not all present in Table 1; they should be collected in a supplementary table to ease verification.
  5. [References] Several references are to arXiv preprints from 2026. If these are not yet available, the paper should note their status; if they are available, the citations should be complete and consistent with the published version where possible.

Circularity Check

0 steps flagged

No load-bearing circularity: task-failure claims are measured externally; the only by-construction element is that the imagination-preserving attack's own objective minimizes the future-drift metric it later reports.

full rationale

The central attack results are self-contained empirical measurements against external benchmarks (LIBERO, RoboTwin). The action-only attack optimizes action deviation Dact (Eq. 8), and the reported closed-loop success drops (e.g., 96.5% to 43.1%, Table 1) are measured, not derived from the objective; nothing forces the mapping from action shift to task failure. The imagination-preserving attack optimizes Dact − λDimg (Eq. 9) with Dimg defined in Eq. 10, so the observation that stronger λ lowers Dimg (Fig. 13) or that the matched-strength objective lowers Dimg on 39/40 tasks (Sec. 5.4, Fig. 12) is a property of the optimization target, not an independent prediction. The non-trivial, non-circular component is that task success remains substantially degraded while Dimg is suppressed—that trade-off is empirically measured. Self-citations [14, 21, 22] provide background definitions and context and are not load-bearing for the attack results; no uniqueness theorem or ansatz is imported from the authors' prior work. Appendix A.1 discloses that several diagnostic studies were run on a balanced subset and are planned to be rerun on the full sweep, and there are numerical inconsistencies between Sec. 5.2 text and Table 1; these are correctness/completeness caveats, not circularity. The derivation chain does not reduce to its inputs.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

The paper does not derive anything from first principles; its contribution is an empirical attack. The hand-chosen attack hyperparameters (ε, λ, search settings) and the simulator/interface assumptions carry the argument. The most substantive premise is the equation of 'plausible future' with small pixel-level distance.

free parameters (3)
  • ε (ℓ∞ perturbation bound) = 0.06 default; swept 0.01–0.20
    Hand-chosen bound that defines 'small visual perturbations'; the main results depend on this magnitude, as shown by the ε sweep in Figure 14.
  • λ (future-preserving weight) = 0.015 default; larger for matched-strength run
    Controls the trade-off in Eq. 9; the central stealthiness claim depends on this coefficient, and Figure 13 reads the trade-off off a sweep over it.
  • Query budget and optimizer step parameters = 8 paired updates; 16 perturbation queries + 1 clean query; c=0.02, η=0.02
    Zeroth-order search settings chosen by hand; the query-budget sweep shows a non-monotonic effect on task success, so results are sensitive to these choices.
axioms (5)
  • standard math Zeroth-order finite-difference estimator (Eq. 11) provides a usable unbiased gradient surrogate for the WAM output objective.
    The attack optimization relies on SPSA-style estimation; this is a standard stochastic approximation result, not a contribution of the paper.
  • domain assumption A deployed WAM can be queried with arbitrary observations and exposes action chunks (and, for two variants, imagined futures) as outputs.
    The threat model in Section 3 requires this interface; if actions and futures are not queryable, the attack does not apply.
  • domain assumption Closed-loop success rate on LIBERO/RoboTwin under the FastWAM training recipe is a valid proxy for embodied task completion.
    All conclusions about 'task failure' are measured in these simulators with specific model variants (Section 5.1); real-robot generalization is not tested.
  • ad hoc to paper A safety monitor that accepts actions based on imagined futures can be modeled as checking a small frame-level/latent distance between clean and attacked predicted futures (Eq. 10).
    This links the paper's stealthiness metric to the claimed safety consequence; it is not independently validated against actual monitor designs.
  • domain assumption The adversary can obtain a clean reference action/future query for the same observation at each replanning step.
    The objective in Eq. 8 requires clean outputs a and z; the paper's query accounting includes one clean reference query per attacked replan (Section A.3).

pith-pipeline@v1.3.0-alltime-deepseek · 18911 in / 13758 out tokens · 107556 ms · 2026-08-01T23:50:19.196769+00:00 · methodology

0 comments
read the original abstract

World-action models (WAMs) are emerging as a promising foundation for embodied control: rather than predicting actions alone, they learn representations that couple action generation with future world prediction. This coupling is often viewed as a source of robustness, interpretability, and safety, as a robot's action can in principle be checked against its imagined future. In this paper, we show that this assumption is fragile. We introduce BadWAM, a unified framework for modeling and evaluating World-Action Drift Attacks: a new class of WAM-specific adversarial attacks that use small visual perturbations to break the alignment between what a WAM imagines and what it executes. BadWAM characterizes this attack surface along two natural criteria: attack strength and stealthiness. When the adversary prioritizes disruption, BadWAM instantiates an action-only adversarial attack, which directly drives the model toward task-failing actions. When the adversary additionally prioritizes stealth, BadWAM instantiates an imagination-preserving adversarial attack, which seeks to induce harmful action shifts while keeping the model's predicted future close to its clean imagination. Together, these two attacks capture a spectrum of WAM-specific failures: from overt action hijacking to stealthier cases where the model appears to imagine a plausible future but executes a desynchronized action. We evaluate BadWAM across different variants of WAMs. Results show that our attacks substantially reduce task success rates under closed-loop execution. For example, our action-only attack reduces the model performance from 96.5% to 43.1% success. The results of our imagination-preserving attack further exposes a WAM-specific vulnerability: moderate future-preserving regularization can maintain strong attack performance while reducing future imagination drift.

Figures

Figures reproduced from arXiv: 2607.15207 by Qi Li, Xinchao Wang, Xingyi Yang.

Figure 2
Figure 2. Figure 2: Action-only adversarial attack produces structured [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Overview of BadWAM. BadWAM injects a small visual perturbation into model observations and performs query-based [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Qualitative illustration of the imagination-preserving objective on IDM WAM. Each panel compares predicted futures [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 6
Figure 6. Figure 6: Comparison with random perturbations on full [PITH_FULL_IMAGE:figures/full_fig_p007_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Mean pass@k across trials on different LIBERO suites. BadWAM lowers success throughout the trial budget instead of only causing isolated unlucky failures. WAM forward queries per attacked replan. Metrics. Our primary metric is closed-loop task success rate; lower success under attack indicates a stronger attack. For a benchmark with T tasks and Ni evaluation episodes for task i, we compute Success = 1 T T … view at source ↗
Figure 8
Figure 8. Figure 8: Per-suite success rates on LIBERO. The attack is [PITH_FULL_IMAGE:figures/full_fig_p008_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Qualitative comparison of clean and attacked rollouts on a LIBERO-10 task. Each row shows synchronized third-person [PITH_FULL_IMAGE:figures/full_fig_p009_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Per-replan action shifts persist across execution and accumulate over time, with failed episodes showing substantially [PITH_FULL_IMAGE:figures/full_fig_p010_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Search dynamics for the imagination-preserving [PITH_FULL_IMAGE:figures/full_fig_p010_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Matched-strength stealth trade-off. The imagination-preserving objective produces consistently smaller predicted [PITH_FULL_IMAGE:figures/full_fig_p011_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Ablation on future-preserving weight λ. Moderate future preservation can improve the action-future tradeoff, while excessive preservation weakens action manipulation. proves attack effectiveness, reducing task success from 64.2% to 56.7% for the joint WAM and from 60.8% to 51.7% for the IDM WAM. However, budget 32 does not further reduce closed-loop success despite its higher per-replan optimiza￾tion cost… view at source ↗
Figure 14
Figure 14. Figure 14: Efficiency and budget sensitivity of BadWAM. Increasing the query budget [PITH_FULL_IMAGE:figures/full_fig_p012_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Augmentation-consistency detection is insufficient [PITH_FULL_IMAGE:figures/full_fig_p013_15.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation

    cs.CR 2026-07 conditional novelty 5.5

    World-model-based embodied AI creates a predictive security boundary where attacks on data, sensors, imagination, ranking, and feedback can turn into unsafe physical action and false safety certificates.

Reference graph

Works this paper leans on

29 extracted references · 13 linked inside Pith · cited by 1 Pith paper

  1. [1]

    pi_0: A vision-language-action flow model for general robot control.arXiv preprint arXiv:2410.24164, 2024

    Kevin Black, Noah Brown, Danny Driess, Adnan Es- mail, Michael Equi, Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, et al. pi_0: A vision-language-action flow model for general robot control.arXiv preprint arXiv:2410.24164, 2024

    Pith/arXiv arXiv 2024

  2. [2]

    Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer

    Tom B. Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. Adversarial patch.arXiv preprint arXiv:1712.09665, 2017

    Pith/arXiv arXiv 2017

  3. [3]

    Attack- ing the trusted imagination: Oracle-level integrity at- tacks on imagine-then-act world models.arXiv preprint arXiv:2606.22966, 2026

    Linghan Chen, Kaiyan Ji, and Minyu Guo. Attack- ing the trusted imagination: Oracle-level integrity at- tacks on imagine-then-act world models.arXiv preprint arXiv:2606.22966, 2026

    Pith/arXiv arXiv 2026

  4. [4]

    Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models

    Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. InProceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pages 15–26, 2017

    2017

  5. [5]

    Abot-m0.5: Unified mobility-and-manipulation world action model.arXiv preprint arXiv:2607.00678, 2026

    Ronghan Chen, Yandan Yang, Zuojin Tang, Dongjie Huo, Tong Lin, Haoning Wu, Haoyun Liu, Yuzhi Chen, Lulu Zheng, Botai Yuan, Tianlun Li, Dekang Qi, et al. Abot-m0.5: Unified mobility-and-manipulation world action model.arXiv preprint arXiv:2607.00678, 2026

    Pith/arXiv arXiv 2026

  6. [6]

    Robotwin 2.0: A scalable data generator and benchmark with strong domain ran- domization for robust bimanual robotic manipulation

    Tianxing Chen, Zanxin Chen, Baijun Chen, Zijian Cai, Yibin Liu, Zixuan Li, Qiwei Liang, Xianliang Lin, Yi- heng Ge, Zhenyu Gu, et al. Robotwin 2.0: A scalable data generator and benchmark with strong domain ran- domization for robust bimanual robotic manipulation. arXiv preprint arXiv:2506.18088, 2025

    Pith/arXiv arXiv 2025

  7. [7]

    Robust physical- world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical- world attacks on deep learning visual classification. In Proceedings of the IEEE Conference on Computer Vi- sion and Pattern Recognition, pages 1625–1634, 2018

    2018

  8. [8]

    Adversarial policies: Attacking deep reinforcement learning

    Adam Gleave, Michael Dennis, Cody Wild, Neel Kant, Sergey Levine, and Stuart Russell. Adversarial policies: Attacking deep reinforcement learning. InInternational Conference on Learning Representations, 2020

    2020

  9. [9]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial exam- ples. InInternational Conference on Learning Repre- sentations, 2015

    2015

  10. [10]

    When world models dream wrong: Physical- conditioned adversarial attacks against world models

    Zhixiang Guo, Siyuan Liang, András Balogh, Noah Lunberry, Rong-Cheng Tu, Márk Jelasity, and Dacheng Tao. When world models dream wrong: Physical- conditioned adversarial attacks against world models. arXiv preprint arXiv:2602.18739, 2026

    arXiv 2026

  11. [11]

    Black-box adversarial attacks with limited queries and information

    Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. InProceedings of the 35th International Conference on Machine Learning, vol- ume 80 ofProceedings of Machine Learning Research, pages 2137–2146. PMLR, 2018

    2018

  12. [12]

    π0.7: A steerable generalist robotic founda- tion model with emergent capabilities.arXiv preprint arXiv:2604.15483, 2026

    Physical Intelligence, Bo Ai, Ali Amin, Raichelle An- iceto, Ashwin Balakrishna, Greg Balke, Kevin Black, George Bokinsky, Shihao Cao, Thomas Charbonnier, et al. π0.7: A steerable generalist robotic founda- tion model with emergent capabilities.arXiv preprint arXiv:2604.15483, 2026

    Pith/arXiv arXiv 2026

  13. [13]

    Openvla: An open-source vision-language-action model

    Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan P Foster, Pannag R Sanketi, Quan Vuong, et al. Openvla: An open-source vision-language-action model. InConference on Robot Learning, pages 2679–2713. PMLR, 2025. 14

    2025

  14. [14]

    Vision-language-action safety: Threats, chal- lenges, evaluations, and mechanisms.arXiv preprint arXiv:2604.23775, 2026

    Qi Li, Bo Yin, Weiqi Huang, Ruhao Liu, Bojun Zou, Runpeng Yu, Jingwen Ye, Weihao Yu, and Xinchao Wang. Vision-language-action safety: Threats, chal- lenges, evaluations, and mechanisms.arXiv preprint arXiv:2604.23775, 2026

    Pith/arXiv arXiv 2026

  15. [15]

    Tactics of adversarial attack on deep reinforcement learning agents

    Yen-Chen Lin, Zhang-Wei Hong, Yuan-Hong Liao, Meng-Li Shih, Ming-Yu Liu, and Min Sun. Tactics of adversarial attack on deep reinforcement learning agents. InProceedings of the 26th International Joint Conference on Artificial Intelligence, pages 3756–3762, 2017

    2017

  16. [16]

    Libero: Benchmark- ing knowledge transfer for lifelong robot learning

    Bo Liu, Yifeng Zhu, Chongkai Gao, Yihao Feng, Qiang Liu, Yuke Zhu, and Peter Stone. Libero: Benchmark- ing knowledge transfer for lifelong robot learning. In Advances in Neural Information Processing Systems, volume 36, 2023

    2023

  17. [17]

    Jailwam: Jailbreaking world action models in robot control.arXiv preprint arXiv:2604.05498, 2026

    Hanqing Liu, Songping Wang, Jiahuan Long, Jiacheng Hou, Jialiang Sun, Chao Li, Yang Yang, Wei Peng, Xu Liu, Tingsong Jiang, et al. Jailwam: Jailbreaking world action models in robot control.arXiv preprint arXiv:2604.05498, 2026

    Pith/arXiv arXiv 2026

  18. [18]

    Oa-wam: Object- addressable world action model for robust robot ma- nipulation.arXiv preprint arXiv:2605.06481, 2026

    Yushan Liu, Peibo Sun, Shoujie Li, Yifan Xie, Lingfeng Zhang, Xintao Chao, Shiyuan Dong, Fang Chen, Xiao- Ping Zhang, and Wenbo Ding. Oa-wam: Object- addressable world action model for robust robot ma- nipulation.arXiv preprint arXiv:2605.06481, 2026

    Pith/arXiv arXiv 2026

  19. [19]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018

    2018

  20. [20]

    Mishra, Yongxin Chen, Danfei Xu, Yang Liu, Xi Chen, and Jiayuan Mao

    Utkarsh A. Mishra, Yongxin Chen, Danfei Xu, Yang Liu, Xi Chen, and Jiayuan Mao. Understanding and mit- igating the video-action generalization gap via temporal ratio.arXiv preprint arXiv:2607.08127, 2026

    Pith/arXiv arXiv 2026

  21. [21]

    Bad- world: Adversarial attacks on world models.arXiv preprint arXiv:2606.16519, 2026

    Linghui Shen, Mingyue Cui, and Xingyi Yang. Bad- world: Adversarial attacks on world models.arXiv preprint arXiv:2606.16519, 2026

    arXiv 2026

  22. [22]

    World action models: A survey.arXiv preprint arXiv:2606.20781, 2026

    Qiuhong Shen, Shihua Zhang, Yue Liao, Qi Li, Zhenx- iong Tan, Shizun Wang, Shuicheng Yan, and Xinchao Wang. World action models: A survey.arXiv preprint arXiv:2606.20781, 2026

    Pith/arXiv arXiv 2026

  23. [23]

    James C. Spall. Multivariate stochastic approxima- tion using a simultaneous perturbation gradient approx- imation.IEEE Transactions on Automatic Control, 37(3):332–341, 1992

    1992

  24. [24]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014

    2014

  25. [25]

    Vt-wam: Visual-tactile world action model for contact-rich manipulation.arXiv preprint arXiv:2607.02503, 2026

    Shuai Tian, Yupeng Zheng, Yuhang Zheng, Songen Gu, Yujie Zang, Yuxing Qin, Weize Li, Haoran Li, Wen- chao Ding, and Dongbin Zhao. Vt-wam: Visual-tactile world action model for contact-rich manipulation.arXiv preprint arXiv:2607.02503, 2026

    Pith/arXiv arXiv 2026

  26. [26]

    Adversarial risk and the dan- gers of evaluating against weak attacks

    Jonathan Uesato, Brendan O’Donoghue, Aaron van den Oord, and Pushmeet Kohli. Adversarial risk and the dan- gers of evaluating against weak attacks. InProceedings of the 35th International Conference on Machine Learn- ing, volume 80 ofProceedings of Machine Learning Research, pages 5025–5034. PMLR, 2018

    2018

  27. [27]

    Fast-wam: Do world action models need test-time future imagination?arXiv preprint arXiv:2603.16666, 2026

    Tianyuan Yuan, Zibin Dong, Yicheng Liu, and Hang Zhao. Fast-wam: Do world action models need test-time future imagination?arXiv preprint arXiv:2603.16666, 2026

    Pith/arXiv arXiv 2026

  28. [28]

    VLMPC: Vision-Language Model Predictive Control for Robotic Manipulation

    Wentao Zhao, Jiaming Chen, Ziyu Meng, DonghuiMao, Ran Song, and Wei Zhang. VLMPC: Vision-Language Model Predictive Control for Robotic Manipulation. In Proceedings of Robotics: Science and Systems, Delft, Netherlands, July 2024

    2024

  29. [29]

    Rt-2: Vision-language- action models transfer web knowledge to robotic control

    Brianna Zitkovich, Tianhe Yu, Sichun Xu, Peng Xu, Ted Xiao, Fei Xia, Jialin Wu, Paul Wohlhart, Stefan Welker, Ayzaan Wahid, et al. Rt-2: Vision-language- action models transfer web knowledge to robotic control. InConference on Robot Learning, pages 2165–2183. PMLR, 2023. 15 Appendix A Details of Experiment Setup A.1 Full and Subset Evaluation Protocols Ta...

    2023