CIVA: Critic-Induced Value-Subspace Attacks on Visual World-Model Agents
Abstract Overview
This paper studies white-box, causal, online adversarial attacks against visual world-model agents, focusing on a frozen DreamerV3 victim. The authors argue that conventional frame-wise pixel attacks are mismatched to these agents because decisions depend on recurrent latent dynamics, which can dilute isolated perturbations over time. They propose CIVA, which first extracts a low-dimensional attack subspace from critic-guided PGD perturbations collected offline, then performs online optimization only over subspace coefficients. An exponential moving average is applied to those coefficients to improve temporal coherence while preserving attack relevance to the victim's value landscape.
Novelty
The distinctive idea is to derive the attack subspace directly from the victim critic's own gradients, rather than from hand-crafted bases, observation statistics, or generic pixel-space optimization. The method combines this critic-induced subspace with causal online optimization and temporal smoothing tailored to recurrent world-model agents.
Results
Across DMC walker walk, Atari Pong, and Crafter, the paper reports that CIVA consistently outperforms five recent observation-space attack baselines. On DMC walker walk, it achieves a 26.07% reward drop with TempAbs 0.646, and on Atari Pong it reaches an 85.71% reward drop with TempAbs 0.394. Ablations further indicate that the critic-induced subspace is the primary source of the gain, while EMA substantially improves temporal smoothness with only a small trade-off in attack strength.
Key Points
- CIVA attacks visual world-model agents by restricting online perturbation search to a low-rank subspace extracted from offline critic-guided PGD perturbations.
- The method is designed for a white-box, causal, online setting with an ℓ∞ budget, using EMA on subspace coefficients to enforce temporal coherence.
- Experiments and ablations show stronger return degradation and lower temporal variation than several baselines, with the critic-derived subspace contributing more than random, full-pixel, or reward-head alternatives.