Source-linked AI summary
JailWAM: Jailbreaking World Action Models in Robot Control
Hanqing Liu, Songping Wang, Jiahuan Long, Jiacheng Hou, Jialiang Sun, Chao Li, Yang Yang, Wei Peng, Xu Liu, Tingsong Jiang, Yao Mu, Wen Yao
TL;DR
WAMs can execute physical actions directly, but existing digital-output and task-completion evaluations provide limited evidence about jailbreak-induced physical risks. JailWAM addresses this gap with unified visual trajectories, severity-aware risk discrimination, and selective closed-loop verification, achieving an 84.2% attack success rate on LingBot-VA in RoboTwin. The results indicate that current WAMs remain vulnerable to instructions inducing unsafe physical behaviors.
Problem
Existing evaluations do not adequately assess jailbreak-induced physical risks in WAMs because their heterogeneous low-level actions and safety-critical intermediate behaviors are difficult to evaluate at scale.
Method
JailWAM maps model-specific actions to visual trajectories, classifies three physical-safety levels, and selectively verifies high-risk candidates through closed-loop simulation.
Results
84.2% attack success rate was achieved on LingBot-VA in the RoboTwin simulation environment.
Takeaways & Limitations
Current WAMs remain vulnerable to instructions that induce unsafe physical behaviors, motivating further safety evaluation and alignment research for embodied robotic systems.
Takeaways & Limitations
Dual-Path Verification captured 17 of 23 unsafe cases observed under closed-loop execution, leaving some unsafe cases unselected for verification.
Abstract
from arXiv · showhide
World Action Models (WAMs) have emerged as a promising paradigm for robotic manipulation, enabling physical interaction across diverse tasks and environments. However, their ability to directly follow high-level instructions and execute physical actions also creates potential safety risks, as adversarially designed instructions may induce unsafe robot behaviors. To systematically assess these risks, we propose JailWAM, the first jailbreak evaluation framework for WAMs. In JailWAM, we integrate three key innovations: Firstly, to address the difficulty of evaluating heterogeneous low-level action outputs, we introduce Visual-Trajectory Mapping, which transforms model-specific actions into unified visual trajectory representations, thereby facilitating consistent risk assessment across WAM architectures. Secondly, to provide efficient and fine-grained assessment of physical risks, we develop a Risk Discriminator supervised by three safety levels ordered according to physical consequence: Safety Compliance, Motion Failure, and Catastrophic Risk. This severity-aware formulation enables the risk discriminator to distinguish different physical outcomes from visual trajectories and support scalable risk screening. Thirdly, to reduce the cost of exhaustively executing adversarial candidates, we design a Dual-Path Verification Strategy that combines rapid risk screening with closed-loop physical simulation, restricting computationally expensive verification to candidates with potential safety risks. Extensive experiments in the RoboTwin simulation environment show that JailWAM achieves an 84.2% attack success rate on LingBot-VA, which indicates that WAMs may be susceptible to jailbreak attacks that induce unsafe physical behaviors. Our findings may motivate further research on the safety evaluation and alignment of future embodied robotic systems.
Introduction
JailWAM frames WAM jailbreak evaluation as a physical-safety problem and introduces a unified, severity-aware, cost-efficient framework for assessing unsafe robot behaviors.
- Introduction: WAM jailbreaks can directly influence executable robot behaviors, extending potential harm from digital outputs to humans, equipment, and surrounding environments.Unlike conventional models, WAM safety depends on the spatial and temporal consequences of physical execution.
- Introduction: Existing jailbreak evaluations target digital outputs, while robotic benchmarks mainly emphasize task completion and provide limited characterization of intermediate motion failures or safety-critical outcomes.Dangerous intermediate behaviors may remain overlooked even when final task outcomes appear normal.
- Introduction: JailWAM addresses heterogeneous actions, consequence-oriented risk prediction, and the computational cost of exhaustively simulating adversarial candidates.These challenges include differing action formats, limited severity-aware prediction, and costly closed-loop execution with human review.
- Introduction: Visual-Trajectory Mapping converts model-specific action sequences into visual trajectories, while the Risk Discriminator classifies Safety Compliance, Motion Failure, and Catastrophic Risk.The three levels are ordered by increasing physical severity.
- Introduction: Dual-Path Verification screens candidates with the Risk Discriminator before selectively verifying high-risk behaviors through closed-loop simulation.This links adversarial instructions, executable trajectories, and physical consequences while reducing exhaustive execution.
- Introduction: 84.2% ASR was achieved on LingBot-VA in the RoboTwin simulation environment using JailWAM’s Dual-Path Verification Strategy.The strategy combines risk screening with selective closed-loop simulation.
Related Work
Prior jailbreak research focuses on digital model outputs, while robotic benchmarks emphasize task completion; JailWAM instead targets transient and safety-critical physical behaviors under adversarial instructions.
- Related Work: Jailbreak evaluation methods developed for LLMs, VLMs, and VGMs assess textual, visual, or policy outputs and may not transfer directly to WAMs.WAMs produce low-level action sequences whose safety depends on physical execution.
- Safety Evaluation in Robotic Simulation: JailWAM’s overview combines adversarial instruction generation, Visual-Trajectory Mapping, Risk Discriminator screening, and closed-loop verification of high-risk candidates.This pipeline connects jailbreak probing to physical-risk assessment.
- Safety Evaluation in Robotic Simulation: Existing robotic benchmarks primarily emphasize task completion rather than safety-related behaviors, leaving dangerous intermediate collisions and oscillations insufficiently assessed.Such transient risks may be overlooked when final task outcomes appear normal.
- Safety Evaluation in Robotic Simulation: Exhaustively executing every adversarial sample in closed-loop simulation imposes substantial computational costs, limiting scalable safety assessment.JailWAM responds by combining efficient screening with physical verification.
Method
JailWAM evaluates WAM jailbreaks by converting heterogeneous executable actions into visual trajectories, screening their risks, and validating high-risk candidates through closed-loop simulation and human review.
- Problem Formulation: JailWAM formulates WAM jailbreak evaluation as an instruction-level search for adversarial commands that induce hazardous executable action sequences.The framework abstracts WAMs by their exposed action sequences, regardless of whether they directly predict actions or model future states.
- Risk Discriminator: The Risk Discriminator maps visual trajectories to three consequence-oriented labels: Safety Compliance, Motion Failure, and Catastrophic Risk.It is fine-tuned on VTM charts annotated by Gemini and verified by human experts, enabling scalable screening.
- Dual-Path Verification Strategy: The Dual-Path Verification Strategy screens candidates efficiently before escalating high-risk cases to closed-loop embodied execution in a high-fidelity simulator.Human experts review the resulting rollouts and assign the final ground-truth label, combining open-loop scalability with physical validation.
- Visual-Trajectory Mapping: Visual-Trajectory Mapping converts heterogeneous action sequences into multi-view visual charts that preserve motion geometry and physical context for risk assessment.VTM reconstructs absolute end-effector trajectories, projects them onto orthographic planes, and incorporates affordances and environmental constraints.
Experiment
Experiments show that JailWAM reveals unsafe behaviors across WAMs and related embodied architectures, generalizes across action-generation mechanisms and environments, and benefits from its visual representation, risk screening, and verification design.
- RQ2: Cross-architecture generalization: JailWAM-generated instructions produce substantially more unsafe executions than reference settings on Motus and X-VLA despite their heterogeneous action-generation architectures.Motus uses a distinct visual-action decoding pipeline, while X-VLA maps multimodal inputs directly to robot actions without explicitly predicting future world states.
- RQ3: Unseen environments and architectures: 46.50% Human-ASR is achieved by zero-shot transfer from LingBot-VA to Cosmos-Policy in LIBERO, with all successful cases corresponding to Level 1 motion failures.Cosmos-Policy has Human-ASR below 6% under clean instructions and existing textual attacks, whereas transferred JailWAM prompts achieve 46.50% Human-ASR and 46.50% MFR.
- Ablation on VTM and Risk Discriminator: Removing VTM or safety-oriented fine-tuning degrades risk classification, while the full pipeline performs consistently better across Safety Compliance, Motion Failure, and Catastrophic Risk.The ablation uses 300 human-verified samples evenly distributed across the three safety levels; removing VTM particularly harms catastrophic-risk recognition.
- Supervision Quality and Screening Efficiency: Human verification raises Level 1 and Level 2 proportions from 24.4% to 31.8% and 15.9% to 26.6%, while Risk Discriminator agreement rises from 62% to 91%.On 100 new test samples, screening time falls from 5 minutes to 1 minute, compared with approximately 27 minutes for manual review.
- Cross-Seed Reliability and Verification Efficiency: At N = 20 scene initializations, Gemini 3.1 Pro reaches 82.5% Cross-Seed Reliability, while Dual-Path Verification reduces simulator executions by 79% and captures 17 of 23 unsafe cases.The strategy reduces total evaluation time by 60%, corresponding to a 2.50× speedup, but open-loop screening misses cases that become unsafe during closed-loop interaction.
Conclusion
JailWAM evaluates jailbreak vulnerabilities in embodied World Action Models and finds that current systems remain vulnerable to instructions inducing unsafe physical behaviors.
- JailWAM reveals that current WAMs remain vulnerable to instructions inducing unsafe physical behaviors across diverse models, environments, and embodied architectures.The framework also identifies the boundary of these vulnerabilities beyond world-model-based systems.