TRAP: Tail-aware Ranking Attack for World-Model Planning

• URL: http://arxiv.org/abs/2605.01950v1
• Date: Sun, 03 May 2026 16:19:45 GMT
• Title: TRAP: Tail-aware Ranking Attack for World-Model Planning
• Abstract summary: We find that world models exhibit a distinct backdoor vulnerability rooted in the long-tailed ranking structure of imagined trajectories.<n>To exploit this vulnerability, we propose TRAP, a backdoor attack framework for world models that targets imagined trajectory ranking.
• Score: 6.036879290384491
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: World models enable long-horizon planning by internally generating and evaluating imagined trajectories, making them a promising foundation for generalist agents. However, this imagination-driven decision process also introduces new security risks. Existing backdoor attacks typically aim to manipulate local features, one-step predictions, or instantaneous policy outputs. While such objectives may suffice for weaker reactive models, they are often ineffective against world models, where the learned dynamics prior and planning process can absorb or wash out the effects of shallow perturbations. More importantly, we find that world models exhibit a distinct backdoor vulnerability rooted in the long-tailed ranking structure of imagined trajectories, where disrupting the ordering of a few decision-critical trajectories can systematically hijack planning. To exploit this vulnerability, we propose TRAP, a backdoor attack framework for world models that targets imagined trajectory ranking. TRAP combines a tail-aware ranking loss to focus optimization on decision-critical trajectories with dual gating mechanisms that stabilize optimization and regulate when and where the attack penalty is applied. Under trigger conditions, TRAP alters the relative ranking of imagined trajectories to redirect planning outcomes, while largely maintaining the normal ranking structure on clean inputs. Experiments on DreamerV3 and TD-MPC2 across diverse tasks show that TRAP consistently induces sustained behavioral deviations and significant performance degradation, highlighting the need for dedicated security evaluation of world-model-based agents.

Related papers

• TrojanWorld: Backdooring World-Model Agents via Imagination Steering [65.38754125569848]
  TrojanWorld is a backdoor framework for world-model agents that induces attacker-specified behavior by steering internal imagination.<n>Under trigger activation, TrojanWorld achieves a target-action deviation as low as 0.026 while retaining at least 98.8% of the corresponding clean performance.
  arXiv  Detail & Related papers  (2026-09-07T05:14:10Z)
• World Models as Adversaries: Multi-Agent Self-Play Fine-Tuning for Robust Motion Planning [60.88859946006306]
  Adversa World Modeling is a theoretically grounded multi-agent self-play fine-tuning framework.<n>In inner minimization, the planner's predictive world model is converted into a role-conditioned adversary that learns sparse, scene-adaptive attack coalitions.<n> Experiments on the nuPlan and InterPlan benchmarks demonstrate that our method generates transferable adversarial interactions.
  arXiv  Detail & Related papers  (2026-07-12T07:44:16Z)
• Shift & Drift: A Zero-Shot Benchmark for Generalizable and Robust Autonomous Driving Motion Planning [60.888463449435484]
  We present Shift & Drift, a novel dual-track benchmark designed to rigorously stress-test motion planners across two critical axes of distribution shift.<n>We show that imitation learning methods achieve high scores in ID benchmarks, but suffer from persistent drift when subjected to temporally correlated actuation noise.<n>Our findings reveal an empirical trade-off between imitation fidelity and closed-loop resilience, providing the community with a rigorous benchmark to evaluate progress toward reliable deployment.
  arXiv  Detail & Related papers  (2026-07-08T18:23:48Z)
• What's Hidden Matters: Identifying Planning-Critical Occluded Agents using Vision-Language Models [13.668330688399516]
  This work bridges the critical gap between perception and planning by enabling Vision-Language Models to identify and reason about hidden agents.<n>We introduce a novel framework that uses Planning KL-divergence (PKL), an information-theoretic metric, to systematically identify and rank occluded agents.<n>We apply this framework to the nuScenes dataset to create a new benchmark focused on high-impact scenarios.
  arXiv  Detail & Related papers  (2026-07-01T00:14:13Z)
• Stealthy World Model Manipulation via Data Poisoning [6.257560917160816]
  We propose SWAAP, the first two-stage data poisoning framework for learned world models.<n>In the first stage, SWAAP identifies a harmful target world model that induces low-return behavior under planning.<n>In the second stage, SWAAP realizes this target through stealth-constrained gradient matching.
  arXiv  Detail & Related papers  (2026-06-17T05:24:18Z)
• PROWL: Prioritized Regret-Driven Optimization for World Model Learning [20.10187986360715]
  We introduce a KL-constrained adversarial curriculum in which a policy is trained to expose high-error trajectories of a diffusion-based world model.<n>We implement our approach in the MineRL framework and evaluate it on held-out out-of-distribution trajectories.
  arXiv  Detail & Related papers  (2026-05-11T14:24:19Z)
• AnchorRefine: Synergy-Manipulation Based on Trajectory Anchor and Residual Refinement for Vision-Language-Action Models [60.04879435087352]
  Vision-language-action (VLA) policies generate actions within a single unified space.<n>We propose AnchorRefine, a hierarchical framework that factorizes VLA action modeling into trajectory anchor and residual refinement.<n> Experiments on LIBERO, CALVIN, and real-robot tasks demonstrate that AnchorRefine consistently improves both regression-based and diffusion-based VLA backbones.
  arXiv  Detail & Related papers  (2026-04-20T04:25:24Z)
• Aligning Agents via Planning: A Benchmark for Trajectory-Level Reward Modeling [19.766968596602457]
  Plan-RewardBench is a trajectory-level preference benchmark designed to evaluate how well judges distinguish preferred versus distractor agent trajectories.<n>Plan-RewardBench covers four representative task families -- (i) Safety Refusal, (ii) Tool-Irrelevance / Unavailability, (iii) Complex Planning, and (iv) Robust Error Recovery.
  arXiv  Detail & Related papers  (2026-04-09T12:35:06Z)
• World Action Verifier: Self-Improving World Models via Forward-Inverse Asymmetry [82.93104394404781]
  General-purpose world models promise scalable policy evaluation, optimization, and planning.<n>We propose World Action Verifier (WAV), a framework that enables world models to identify their own prediction errors and self-improve.
  arXiv  Detail & Related papers  (2026-04-02T12:48:36Z)
• TopoCurate:Modeling Interaction Topology for Tool-Use Agent Training [53.93696896939915]
  Training tool-use agents typically rely on Supervised Fine-Tuning (SFT) on successful trajectories and Reinforcement Learning (RL) on pass-rate-selected tasks.<n>We propose TopoCurate, an interaction-aware framework that projects multi-trial rollouts from the same task into a unified semantic quotient topology.<n>TopoCurate achieves consistent gains of 4.2% (SFT) and 6.9% (RL) over state-of-the-art baselines.
  arXiv  Detail & Related papers  (2026-03-02T10:38:54Z)
• PathWise: Planning through World Model for Automated Heuristic Design via Self-Evolving LLMs [16.59846708454225]
  We propose a novel multi-agent reasoning framework, referred to as Planning through World Model for Automated Heuristic Design via Self-Evolving LLMs (PathWise)<n>PathWise formulates a sequential decision process over an entailment graph serving as a compact, stateful memory of the search trajectory.<n> Experiments across diverse COPs show that PathWise converges faster to better generalizes, generalizes across different LLM backbones, and scales to larger problem sizes.
  arXiv  Detail & Related papers  (2026-01-28T12:34:50Z)
• NoTVLA: Narrowing of Dense Action Trajectories for Generalizable Robot Manipulation [54.87964060934928]
  Vision-Language-Action (VLA) models confront critical barriers to real-world deployment, most notably catastrophic forgetting.<n>We propose the Narrowing of Trajectory VLA framework: a novel approach that narrows its focus to sparse trajectories.<n>NoTVLA achieves superior performance and generalization compared to pi0 while operating under two critical constraints.
  arXiv  Detail & Related papers  (2025-10-04T18:26:55Z)
• Deep Active Inference Agents for Delayed and Long-Horizon Environments [1.693200946453174]
  AIF agents rely on accurate immediate predictions and exhaustive planning, a limitation that is exacerbated in delayed environments.<n>We propose a generative-policy architecture featuring a multi-step latent transition that lets the generative model predict an entire horizon in a single look-ahead.<n>We evaluate our agent in an environment that mimics a realistic industrial scenario with delayed and long-horizon settings.
  arXiv  Detail & Related papers  (2025-05-26T11:50:22Z)
• Plan-R1: Safe and Feasible Trajectory Planning as Language Modeling [74.41886258801209]
  We propose a two-stage trajectory planning framework that decouples principle alignment from behavior learning.<n>Plan-R1 significantly improves planning safety and feasibility, achieving state-of-the-art performance.
  arXiv  Detail & Related papers  (2025-05-23T09:22:19Z)
• Rejecting Hallucinated State Targets during Planning [84.179112256683]
  In planning processes, generative or predictive models are often used to propose "targets" representing sets of expected or desirable states.<n>Unfortunately, learned models inevitably hallucinate infeasible targets that can cause delusional behaviors and safety concerns.<n>We devise a strategy to identify and reject infeasible targets by learning a target feasibility evaluator.
  arXiv  Detail & Related papers  (2024-10-09T17:35:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.