mlsanityData to 14 Oct 2026

CIVA: Critic-Induced Value-Subspace Attacks on Visual World-Model Agents

arXiv 2608.21114 ↗First posted 21 Aug 2026cs.CV cs.AIcited by 0

On the map: World models → World model security and GUI agents

Abstract (arXiv)

Visual world-model agents such as DreamerV3 act through a recurrent latent state rather than a single observation, which weakens frame-wise observation attacks and makes their perturbations vary sharply over time under a strict per-frame perturbation constraint. We study white-box, causal, online attacks on such agents and propose Critic-Induced Value-Subspace Attacks (CIVA). Our key observation is that, along a rollout, critic-guided perturbations concentrate in a low-dimensional subspace induced by the victim's own critic. Based on this observation, CIVA first probes the frozen victim offline with critic-guided PGD and extracts a low-rank value-subspace by SVD. At test time, it optimizes only the subspace coefficients, smooths them with an exponential moving average (EMA), and maps them back to pixels. This design attacks value-sensitive recurrent dynamics while keeping the online optimization cheap and temporally coherent. Extensive experiments on DMC walker walk, Atari Pong, and Crafter show that CIVA consistently outperforms five recent methods; on DMC walker walk, it achieves the largest reward drop of 26.07% while keeping temporal variation low, with TempAbs of 0.646.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in World model security and GUI agents, one of 11 directions in World models. Builds on 59 of its 75 references that are in the map. First posted on arXiv 21 Aug 2026.

Builds on

59 of 75 references.

Closest ancestors · 1

Same direction, newest first

  1. 2026When World Models Dream Wrong: Physical-Conditioned Adversarial Attacks against World Models21 Feb

Other references · 58

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2013Intriguing properties of neural networkscited by 5,155
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  5. 2019Dream to Control: Learning Behaviors by Latent Imaginationcited by 1,653
  6. 2019Mastering Atari, Go, Chess and Shogi by Planning with a Learned Modelcited by 1,353
  7. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  8. 2023Mastering Diverse Domains through World Modelscited by 1,253
  9. 2020Mastering Atari with Discrete World Modelscited by 1,007
  10. 2018DeepMind Control Suitecited by 956
  11. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  12. 2018Recurrent World Models Facilitate Policy Evolutioncited by 785
38 more
  1. 2016Universal adversarial perturbationscited by 784
  2. 2024Genie: Generative Interactive Environmentscited by 747
  3. 2023TD-MPC2: Scalable, Robust World Models for Continuous Controlcited by 512
  4. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  5. 2017Robust Adversarial Reinforcement Learningcited by 451
  6. 2022DayDreamer: World Models for Physical Robot Learningcited by 400
  7. 2021Multi-attentional Deepfake Detectioncited by 341
  8. 2022Transformers are Sample-Efficient World Modelscited by 328
  9. 2017Adversarial Attacks on Neural Network Policiescited by 320
  10. 2024Diffusion for World Modeling: Visual Details Matter in Ataricited by 300
  11. 2020Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observationscited by 238
  12. 2019Adversarial Policies: Attacking Deep Reinforcement Learningcited by 214
  13. 2021Benchmarking the Spectrum of Agent Capabilitiescited by 200
  14. 2017Tactics of Adversarial Attack on Deep Reinforcement Learning Agentscited by 166
  15. 2024Understanding World or Predicting Future? A Comprehensive Survey of World Modelscited by 166
  16. 2017Robust Deep Reinforcement Learning with Adversarial Attackscited by 154
  17. 2023Transformer-based World Models Are Happy With 100k Interactionscited by 139
  18. 2021Robust Reinforcement Learning on State Observations with Learned Optimal Adversarycited by 135
  19. 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
  20. 2017Delving into adversarial attacks on deep policiescited by 104
  21. 2023STORM: Efficient Stochastic Transformer based World Models for Reinforcement Learningcited by 89
  22. 2018Low Frequency Adversarial Perturbationcited by 80
  23. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  24. 2020Robust Deep Reinforcement Learning through Adversarial Losscited by 75
  25. 2020Efficient Adversarial Attacks for Visual Object Trackingcited by 66
  26. 2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 59
  27. 2018Sparse Adversarial Perturbations for Videoscited by 57
  28. 2021Who Is the Strongest Enemy? Towards Optimal and Efficient Evasion Attacks in Deep RLcited by 55
  29. 2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
  30. 2022Efficient Adversarial Training without Attacking: Worst-Case-Aware Robust Reinforcement Learningcited by 43
  31. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  32. 2024Visual Adversarial Attack on Vision-Language Models for Autonomous Drivingcited by 36
  33. 2019Subspace Attack: Exploiting Promising Subspaces for Query-Efficient Black-box Attackscited by 35
  34. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  35. 2018Adversarial Perturbations Against Real-Time Video Classification Systemscited by 32
  36. 2024Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Cloudscited by 24
  37. 2025Black-Box Adversarial Attack on Vision Language Models for Autonomous Drivingcited by 24
  38. 2023Improving Adversarial Transferability by Stable Diffusioncited by 22

50 most cited of 58 All 58 (JSON)

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025SEBA: Sample-Efficient Black-Box Attacks on Visual Reinforcement Learning
  2. 2026ARB4WM: An Adversarial Robustness Benchmark for World Models in Continuous Control
  3. 2026BadWorld: Adversarial Attacks on World Models
  4. 2026Improving Weak World Models Behind Strong Agents in Atari Pong
  5. 2025AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Models
  6. 2026WCM: A World Critic Model for Vision-Language-Action Reinforcement Learning
  7. 2026π-StepNFT: Wider Space Needs Finer Steps in Online RL for Flow-based VLAs
  8. 2026Inject Once Survive Later: Backdooring Vision-Language-Action Models to Persist Through Downstream Fine-tuning