Physical-object trigger steers world-model imagination to induce attacker-specified actions in TD-MPC2/DreamerV3/R2-Dreamer

Auto-published from arXiv:2609.07051 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.82, flags: [no-prompt-excerpt, possible-zero-day])

Category

backdoor-attack

Model

TD-MPC2, DreamerV3, R2-Dreamer

Surface

agent harness (model-based RL with world model, 64×64 camera observations)

Setup

Attacker poisons world model weights during training via Decision-Reflective Induction, which uses frozen decision-module feedback to steer trigger-conditioned imagined trajectories toward a target action a† (e.g., a†=0.5 across all action dimensions). At deployment, a non-colliding magenta sphere is physically placed in the scene and rendered through the agent's standard camera starting at t=⌊Tₑₚ/2⌋ for ~16% of episode duration — no post-capture pixel editing occurs. No literal prompt excerpt; this is a model-based RL agent with no natural-language interface.

Reproduction anchor

benchmark: DeepMind Control (Finger Spin, Walker Walk), MetaWorld (Drawer Open, Window Close), MyoSuite (Key Turn, Object Hold), RoboDesk (Push Green, Push Red). Hyperparams reported: λ_a=1, λ_c=0.5, H_c=2 (TD-MPC2) / H_c=8 (actor-based models). No code release found in paper or abstract page.

Observed behavior

Under trigger activation, target-action deviation (EE metric) falls as low as 0.026 on R2-Dreamer (DMC). Task Degradation Rate reaches up to 90% on RoboDesk. In the Drawer Open case study, the backdoored arm is redirected before the drawer goal is reached; in Push Green, the agent is driven away from an already-successful configuration — both matching the attacker-specified constant action vector.

Expected behavior

Agent should treat non-colliding, task-irrelevant scene objects as distractors and continue completing the assigned task with performance indistinguishable from a clean model.

Reproducibility

medium

Threat model

Robotics and simulation teams that download pretrained world models from public repositories for fine-tuning or deployment face a supply-chain attack: a malicious model distributor poisons weights before upload. A physical adversary can then activate the backdoor at runtime simply by placing a cheap prop (e.g., a colored sphere) in the physical environment, with no need to digitally intercept or manipulate camera feeds.

Novelty

First attack to exploit the world model's internal imagination/planning module as the corruption pathway, enabling a physical (non-digital) trigger that activates through the agent's native perception pipeline — a fundamentally different attack surface from prior digital-pixel-manipulation backdoors.

Source

• arXiv: 2609.07051
• PDF: https://arxiv.org/pdf/2609.07051
• Categories: cs.LG, cs.CR
• Authors: Wenkai Huang, Siyuan Liang, Gaolei Li, Yiming Li, Tianhao Peng, Jianhua Li, Dacheng Tao

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 2
• triage reason: TrojanWorld demonstrates concrete backdoor attacks on world-model agents (TD-MPC2, DreamerV3, R2-Dreamer) using physical triggers, achieving precise behavioral control (0.026 deviation) and post-trigger persistence. Paper submitted today with no disclosed vendor notification in abstract.

─────────────────────────────────────────────────────────────────────