Small visual perturbations can collapse the imagined future of a multimodal agent [1]. The BadWAM study shows that minute visual tweaks steer video‑language‑action pipelines toward wildly different predicted frames, breaking the alignment between what the model envisions and what it executes.
World‑action models have been promoted as self‑checking controllers because they generate an explicit forecast of the scene before acting. By coupling future prediction with action generation, researchers have argued that a robot can verify its plan against an imagined trajectory, ostensibly improving safety and interpretability.
BadWAM’s action‑only attack slashes overall task success from 96.5 % to 43.1 % [1]. The degradation is systematic: spatial success falls to 16.0 %, goal success to 40.0 %, and long‑horizon success to 23.5 %, demonstrating that the drift permeates every evaluation metric.
The imagination‑preserving variant trims the average predicted‑future distance from 14.01 to 13.04 while staying within the same perturbation budget [1]. By keeping the imagined frames visually close to the clean prediction, the attack remains stealthy yet still forces harmful action shifts, exposing a failure mode invisible to naive visual inspection.
The study evaluates FastWAM checkpoints on LIBERO, leaving open whether larger, diversified models share the same fragility. This suggests that future work must probe scaling effects and explore defenses beyond modest regularization, such as adversarial training tailored to trajectory consistency.
Robustness suites for embodied agents should incorporate drift attacks as a mandatory benchmark before deployment. Adding an adversarial‑drift slot to existing evaluation pipelines will force developers to harden the imagination‑action loop rather than assuming it is intrinsically safe.
If imagined futures cannot be trusted under imperceptible perturbations, can they ever serve as a reliable safety oracle?
