BadWAM: A Robot Can Imagine Correctly and Still Act Wrong

The safety argument for world-action models rests on a single assumption: if a robot can check its intended action against an imagined future, bad actions get caught before execution. BadWAM breaks that assumption directly. Small visual perturbations can decouple what a model imagines from what it actually does, producing plausible-looking predictions alongside task-failing behavior.

World-action models (WAMs) are a class of embodied control architectures that jointly learn action generation and future world prediction. The coupling is the point: the imagined future acts as an internal check on the action, giving operators a window into the model's intent. BadWAM introduces a framework called World-Action Drift Attacks that targets exactly this coupling. The attack surface splits along two axes: how much disruption the adversary wants, and how much concealment.

The overt variant, the action-only attack, drives the model toward task-failing actions without constraining what happens to the imagined future. The stealth variant, the imagination-preserving attack, adds a regularization term that keeps the predicted future close to what the model would have imagined without the perturbation. That second variant is the more unsettling finding. It shows that an adversary can maintain a convincing internal narrative while the executed action diverges from it. The model looks fine from the inside. It is not.

Across closed-loop evaluation on multiple WAM variants, the action-only attack drops task success from 96.5% to 43.1%. The imagination-preserving attack sustains strong attack performance with moderate future-preserving regularization, confirming the decoupling is achievable without sacrificing concealment. For teams building or evaluating embodied AI systems that use world prediction as a safety or interpretability signal, the takeaway is direct: that signal cannot be treated as a reliable proxy for action correctness under adversarial conditions.

We're thinking: We find the imagination-preserving result more consequential than the raw success-rate drop. The field has been building interpretability arguments for WAMs on the premise that visible internal predictions create accountability. BadWAM shows that accountability layer can be spoofed, not by hiding the prediction, but by keeping it intact while the action underneath shifts. That inverts the trust model entirely. Teams that added world prediction specifically to make their robots more auditable now have a harder problem: the audit log can look clean while the behavior is compromised. This suggests that action verification in embodied systems needs independent grounding, not just consistency checks against the model's own imagination.

Key takeaways:

• WAM safety assumptions break because action generation and world prediction are coupled in training but can be decoupled at inference time through targeted visual perturbations, with no architectural change required.
• The action-only attack reduces task success from 96.5% to 43.1% across closed-loop evaluation; the imagination-preserving variant achieves comparable disruption while keeping predicted futures near the clean baseline, though evaluations are currently simulation-based.
• Teams deploying WAMs in safety-sensitive embodied settings should treat world-prediction consistency as one signal among several, not as a standalone action-validity check, and audit action outputs independently of imagined futures.

Source: BadWAM: When World-Action Models Dream Right but Act Wrong