TrojanWorld backdoor persists in world-model agent after physical trigger is removed from scene

Auto-published from arXiv:2609.07051 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.82, flags: [possible-zero-day, no-prompt-excerpt])

Category

backdoor-attack

Model

TD-MPC2, DreamerV3, R2-Dreamer

Surface

agent harness (model-based RL, trigger-free post-activation environment)

Setup

A world model backdoored with TrojanWorld's Causal Propagation component (H_c=2 for TD-MPC2, H_c=8 for actor-based models) is activated by brief trigger exposure (~16% of episode), then the physical trigger object is removed from the scene for the remainder of the episode. The paper does not provide a verbatim configuration file or code snippet; setup is described algorithmically in the paper body.

Reproduction anchor

benchmark: DMC (Walker Walk), MetaWorld (Window Close) used as case studies for post-removal evaluation. Hyperparams: H_c=2 (TD-MPC2), H_c=8 (actor-based). No code release found.

Observed behavior

Post-removal target-action deviation (Post-EE) falls as low as 0.020 on R2-Dreamer (DMC), nearly matching in-trigger performance. The compromised agent remains 'trapped' in the induced behavioral trajectory, continuing to execute attacker-specified actions across subsequent timesteps even with no ongoing trigger stimulus.

Expected behavior

After trigger removal, the agent should immediately revert to normal task-completion behavior indistinguishable from a clean model — trigger-free observations should produce clean-model-equivalent actions.

Reproducibility

medium

Threat model

Deployers of world-model agents in physical environments (robotic manipulation, autonomous navigation) where an attacker can briefly introduce and then remove a trigger prop. After a single brief exposure, the attacker needs no continued physical presence — the compromised behavior is self-sustaining, making forensic attribution extremely difficult and enabling plausibly-deniable sabotage.

Novelty

Demonstrates a one-shot trigger-then-remove attack pattern where backdoor control outlasts trigger visibility, enabled by Causal Propagation training — a qualitatively new threat shape not addressed by prior world-model or RL backdoor literature.

Source

• arXiv: 2609.07051
• PDF: https://arxiv.org/pdf/2609.07051
• Categories: cs.LG, cs.CR
• Authors: Wenkai Huang, Siyuan Liang, Gaolei Li, Yiming Li, Tianhao Peng, Jianhua Li, Dacheng Tao

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 2
• triage reason: TrojanWorld demonstrates concrete backdoor attacks on world-model agents (TD-MPC2, DreamerV3, R2-Dreamer) using physical triggers, achieving precise behavioral control (0.026 deviation) and post-trigger persistence. Paper submitted today with no disclosed vendor notification in abstract.

─────────────────────────────────────────────────────────────────────