PaperlayerView exact revision on arXiv

Source-linked AI summary

TAPDreamer: Transferable Adversarial Patches for World Action Models

Xuanyu Lu, Fengqing Jiang, Kaiyuan Zheng, Yichen Feng, Yaorui Ding, Yuetai Li, Zhen Xiang, Bhaskar Ramasubramanian, Basel Alomair, Luyao Niu, Radha Poovendran

arXiv:2610.06814v2cs.CVcs.AIcs.RO

TL;DR

World action models rely on camera-based visual representations that are reused across tasks and models, creating an exposed input channel for transferable perturbations. TAPDreamer optimizes a fixed patch using a public visual encoder and a few observations from one source task, without target-policy queries. In closed-loop tests, it reduces FastWAM success to 0.00% on both LIBERO and RoboTwin and also transfers across action architectures.

  • Problem

    World action models rely on visual representations built from camera inputs, and reused encoders expose a channel through which perturbations may transfer across tasks and models.

    Source: §1 · pp. 1–2

  • Method

    TAPDreamer maximizes final-latent displacement through a public visual encoder using source-task demonstration frames, then freezes and reuses the patch without policy outputs.

    Source: §1 · p. 2

  • Results

    FastWAM success falls from 97.65% to 0.00% on LIBERO and from 90.86% to 0.00% on RoboTwin; transfer reduces success to 1.45% on DreamWAM-uncond, 1.00% on DreamWAM-joint, and 10.60% on Motus.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Mechanism analysis suggests defenses could attenuate keys and values from suspicious image regions or train encoders to preserve representations outside locally perturbed regions.

    Source: Ethics statement · p. 11

    Experiments were conducted in the LIBERO and RoboTwin simulation environments.

    Source: Ethics statement · p. 11

Abstract

from arXiv · show

World models learn to predict how their environment will evolve, making them an important foundation for general-purpose robotic control. Yet world action models depend on camera inputs whose manipulation can corrupt the visual representations used across tasks and action policies. Existing attacks on these models optimize against the victim's actions or predicted futures and therefore require access to target-model outputs. In this paper, we propose an attack, TAPDreamer, against world action models that instead uses a public encoder alone to construct a fixed local perturbation that transfers across tasks and action architectures. TAPDreamer requires no target-policy queries. Our key insight is that interactions between patch-induced changes in attention weights and value vectors broadcast a nearly identical representation shift far beyond the patch footprint, and this shift remains stable across task observations. Guided by this insight, TAPDreamer uses six frames from one source task to maximize the global L1 distance between clean and patched encoder representations. In closed-loop evaluation, one frozen patch per benchmark, covering about 6.5% of the input, reduces FastWAM's success rate from 97.7% to 0.0% across 40 LIBERO tasks and from 90.86% to 0.0% across 50 RoboTwin tasks; matched random patches retain 81.5% and 79.2% success. The same patches reduce success to 1.45% and 1.00% on two DreamWAM configurations and to 10.60% on Motus. These results show that protecting downstream action generation alone is insufficient: defenses for world action models must also secure shared visual encoders against persistent local perturbations.

1. Introduction

World action models learn how visual environments evolve alongside robot actions, but their reliance on shared visual encoders exposes a transferable input channel. TAPDreamer exploits that channel with a fixed patch optimized using a public encoder, sharply reducing success across tasks and models.

1. Introduction

  • Because visual encoders are reused across tasks and models, an externally accessible camera channel can enable perturbations to bypass model-specific action heads.World action models learn how the visual world evolves with robot actions, capturing objects, spatial relationships, and motion.Source: §1 · pp. 1–2
  • TAPDreamer maximizes final-latent displacement with a few demonstration frames from one source task, then deploys the unchanged patch across target tasks and models.The attack requires no action labels, task rewards, simulator, victim-model weights, or policy outputs.Source: §1 · p. 2
  • FastWAM success falls from 97.65% to 0.00% on LIBERO and from 90.86% to 0.00% on RoboTwin; matched random patches retain 81.45% and 79.20%.The single frozen patch covers approximately 6.5% of the input, and the results cover 40 LIBERO tasks and all 50 RoboTwin tasks.Source: §1 · p. 2

2. World Action Model, Threat Model, and TAPDreamer

World action models encode camera observations into representations used to construct downstream context and generate actions. TAPDreamer assumes an attacker can alter a fixed local image region and optimizes a patch against a public visual encoder for reuse across tasks and models.

2.1. World Action Model

  • A world action model encodes camera observations into visual latents, combines them with language, proprioception, and history, then predicts future visual latents and action chunks.In closed-loop execution, it executes part of each action chunk, receives new observations, and generates the next chunk.Source: §2.1 · p. 3

2.2. Threat Model

  • The attacker seeks to reduce task success by modifying a small visual-input region and has public encoder weights, gradients, and single-task demonstration images.The patch stays fixed in content, position, and area and is reused across target tasks and models within each benchmark; the attacker does not access downstream model gradients, action labels, or task rewards for optimization.Source: §2.2 · p. 3

2.3. Attack Design and Implementation

  • TAPDreamer exploits shared public visual encoders by maximizing clean-to-patched representation differences across the full latent output and multiple source observations.The resulting patch is optimized within a fixed mask and valid pixel range, then frozen for reuse across tasks and models within the benchmark.Source: §2.3 · pp. 4–5, Figure 2 · p. 4

3. Experiments

Experiments test frozen local patches in closed-loop LIBERO and RoboTwin tasks and across downstream action architectures. TAPDreamer sharply lowers success compared with clean inputs and matched random patches.

3.1. Experimental Setup

  • Evaluation uses closed-loop success on LIBERO and RoboTwin, with frozen patches covering 6.54% and 6.59% of the input, respectively; transfer is tested on held-out tasks.The evaluation includes FastWAM, DreamWAM-uncond, DreamWAM-joint, and Motus, each retaining its own action-generation process and preprocessing.Source: §3.1 · p. 5

3.2. Experimental Results

  • 97.65% to 0.00% on LIBERO and 90.86% to 0.00% on RoboTwin: a frozen TAPDreamer patch reduces FastWAM success across both benchmarks.Table 1 covers the complete task sets, with one fixed patch per benchmark.Source: §3.2 · p. 6, Table 1 · p. 6
  • 81.45% LIBERO and 79.20% RoboTwin success remain with matched random patches, versus 0.00% with TAPDreamer, indicating the effect is not solely region occlusion.The random patch matches the adversarial patch's position and area.Source: §3.1 · p. 5, §3.2 · p. 6
  • 1.45% on DreamWAM-uncond, 1.00% on DreamWAM-joint, and 10.60% on Motus: success remains low when the frozen patch transfers across architectures.Matched random patches retain 84.55%, 86.10%, and 82.40% success, respectively; transfer uses no target-model feedback for reoptimization.Source: Table 2 · p. 6, §3.2 · p. 7
  • DreamWAM-uncond is strongly affected despite not reading explicitly generated future frames to predict actions, so explicit test-time future-video generation is not necessary for the attack.Figure 3 depicts patch-induced changes spreading through bottleneck attention to the final latent, with a shared source-template component and observation-specific residuals.Source: §3.2 · p. 7, Figure 3 · p. 7

4. Mechanism and Behavioral Analysis

TAPDreamer’s local perturbation spreads through attention into a coherent latent shift beyond the patch footprint. That shift remains aligned across held-out observations, supporting transfer across changing scenes.

4.1. A local patch becomes a distributed latent shift

  • About 71% of representation-change energy is outside the footprint at attention output and 79% in the final latent, versus under 1% at attention input.A same-size random patch leaves changes largely within the footprint; the attention layer helps the optimized change reach distant positions.Source: §4.1 · p. 7, Table 3 · p. 8
  • The joint change in attention weights and values is TAPDreamer’s largest measured component, unlike the small joint term for a random patch.This points to coordinated weight and value changes rather than greater attention to the patch alone.Source: §4.1 · pp. 7–8
  • Restoring clean attention weights or values substantially reduces latent and action changes, suppressing perturbations outside the footprint while leaving residual effects near the patch.The same interventions have little effect on the random patch.Source: §4.1 · p. 8, Figure 4 · p. 8

4.2. The latent shift repeats across observations

  • The source template’s median cosine similarity with held-out changes is 0.981, while clean representations have cross-task cosine similarity of 0.371.The median lower-bound-to-observed L1 displacement ratio is 0.833 (range 0.732–0.918), indicating that the fixed template retains much of the measured displacement.Source: §4.2 · pp. 9–10
  • About 95.3% of final-latent change energy outside the footprint lies in a shared spatial component, whose direction has cross-task cosine similarity of about 0.997.K/V templates from the source task closely reproduce the broadcast on new images with clean context.Source: §4.2 · pp. 9–10

5. Related Work

Prior work studies adversarial perturbations, localized patches, and attacks on vision-language-action policies and world models. TAPDreamer differs by using a public visual encoder to optimize a fixed local patch and testing its effects in closed-loop control.

Related work

  • Prior localized attacks include LaVAN [Karmon et al., 2018] and attention-aware Patch-Fool, while PhotoGuard [Salman et al., 2023] targets encoder-level diffusion editing.Other work explores universal perturbations, cross-model transfer, feature-level objectives, and physical attacks.Source: §5 · p. 10

Attack on vision-language-action policies

  • VLA attacks target actions or representations, but action-based gradients require access through action-generation interfaces.TAPDreamer instead studies fixed local attacks on a public generative visual encoder and their transfer mechanism.Source: §5 · pp. 10–11

Adversarial threats to world models and world action models

  • Prior WAM threats target generated videos, use online target-model queries, optimize end-to-end through world models, or control language instructions.TAPDreamer instead uses a fixed local patch optimized through a public visual encoder for closed-loop attacks across tasks and WAM architectures.Source: §5 · p. 11

6. Conclusion

TAPDreamer uses a public visual encoder and six observations from one task to optimize a fixed local patch that interferes across benchmarks and action architectures. The study’s experiments are simulation-based, and the proposed defenses remain to be evaluated against adaptive attacks and clean-task effects.

6. Conclusion

  • TAPDreamer uses a public visual encoder and six observations from one task to produce closed-loop interference across two complete benchmarks and different downstream action architectures.The reported mechanism involves attention-weight and value-change interactions that broadcast local interference, with responses consistent across task observations.Source: §6 · p. 11

Ethics statement

  • Experiments use LIBERO and RoboTwin simulations, and the proposed key/value defenses have not been evaluated against adaptive attacks or for clean-task impact.The paper recommends restricting use of the attack to authorized security testing and research.Source: Ethics statement · p. 11

A.1. Patch area and position

Patch-area and position ablations on FastWAM show that optimized content matters and that effective patches can be reoptimized at different tested locations. An unchanged patch does not transfer directly between the tested positions.

A.1. Patch area and position

  • Increasing patch area from 3.35% to 3.96% reduces TAPDreamer success from 65.60% to 3.85%, while matched random-patch success changes from 90.80% to 89.25%.The contrast indicates that the degradation depends on optimized patch content rather than increased occlusion alone.Source: §A.1 · p. 14, Figure 6 · p. 15
  • Reoptimized patches achieve 0.00% success at all four tested positions, but moving the unchanged upper-left patch yields 93.50%–95.00% success at the other corners.The moved-patch outcomes are close to the corresponding random-patch results.Source: §A.1 · pp. 14–15, Table 5 · p. 15

A.2. Direct transfer of VLA patches

Directly transferred VLA patches leave FastWAM success largely intact, while TAPDreamer reduces it to zero. Attention-restoration interventions remove most TAPDreamer-induced latent and action changes but have little effect on random-patch latent change.

A.2. Direct transfer of VLA patches

  • The VLA attack comparison uses transfer-only evaluation because VLA and WAM paradigms are incompatible.UPA-RFAS and UADA patches were optimized on their source VLAs, then transferred directly to FastWAM.Source: §A.2 · p. 15
  • TAPDreamer reduces FastWAM success to 0% across all four suites, versus 76.55% for UPA-RFAS, 75.85% for UADA, and 81.45% for random patches.The VLA patches were transferred without further optimization and had area matched to TAPDreamer.Source: §A.2 · p. 15, Table 6 · p. 16

B.1. Attention-restoration interventions

  • Attention-restoration ratios measure retained changes, not task success, using L2 norms over the full latent and action outputs.The random-patch comparison uses the same latent-retention metric.Source: §B.1 · p. 16
  • Attention restoration leaves about 33% of TAPDreamer-induced latent change and 32% of action change, while random-patch latent retention remains about 1.000.Restoring the attention branch, its weights, or its values removes most TAPDreamer-induced changes, with little effect on random-patch latent change.Source: §B.1 · p. 16, Table 7 · p. 16

B.2. Optimization trajectories

Across three initializations, optimization establishes a shared displacement direction early, then mainly amplifies it on source and held-out observations. Figure 7 tracks displacement, alignment, effective rank, and a frozen-template lower-bound ratio.

B.2. Optimization trajectories

  • Within 25 steps, template agreement reaches at least 0.964 and effective rank falls below 1.39, while source displacement is only about 12% of its final magnitude.Subsequent optimization mainly amplifies displacement on source and held-out observations while maintaining high alignment.Source: §B.2 · pp. 16, 18, Figure 7 · p. 17
  • Figure 7 shows displacement growing on both source and held-out observations as a common direction emerges early and becomes dominant.The frozen source-derived template accounts for a substantial fraction of held-out displacement even after subtracting the residual.Source: Figure 7 · p. 17, §B.2 · p. 18
  • Figure 7 measures final-latent changes on 356 spatial cells outside the patch footprint; its source template averages displacement over 12 source states and is evaluated on 36 held-out states.Panel (a) reports median L1 displacement and panel (b) reports held-out cosine similarity to the source template.Source: Figure 7 · p. 17, §B.2 · p. 18
  • Figure 7(c) stacks 48 flattened displacement fields and reports effective rank, where a value near one indicates that fields largely share one direction.Panel (d) reports the median frozen-template lower-bound ratio to measured L1 displacement over held-out states; colors distinguish initializations, and dotted lines show random-patch results.Source: Figure 7 · p. 17, §B.2 · p. 18

B.3. Behavioral effects

TAPDreamer changes commands at a fixed physical state and routes visual interference into actions through model-specific pathways. Continued exposure can compound physical consequences, while task recovery after patch removal depends on the resulting state.

Visible execution failures

  • Figure 8 contrasts clean and TAPDreamer observation sequences and end-effector trajectories; the patched path goes below the clean trajectory and prevents task completion.The plotted paths use world-coordinate meters, with a triangle marking the start and stars marking endpoints.Source: §B.3 · p. 18, Figure 8 · p. 19

Immediate action changes

  • A shared target explains 78.2% of variation across 1,500 paired patched and clean pose commands; patched commands suppress lifting, bias poses downward, and shift gripper commands toward opening.These are state-level measurements rather than independent episodes, and the bias can cause different failures depending on task stage.Source: §B.3 · p. 18

Action pathways across models

  • In Motus, restoring the visual-world-dynamics branch recovers about 93%–99% of action change, versus about 10%–27% for the visual-language branch; restoring predicted futures also substantially recovers actions in DreamWAM-joint.The route from disturbed representation to control depends on the model's action pathway.Source: §B.3 · pp. 18–19

Continued exposure and recovery

  • After patch removal, gripper commands shift toward closing at the first clean replan, but recovery depends on physical state; continuous exposure maintains strong failure.Some tasks finish after removal following 20 corrupted replans, while dropped or misplaced objects and missed opportunities may persist.Source: §B.3 · p. 19
Loading 2610.06814v2…