Threat Model
We consider an attacker who aims to reduce the task success rate of a World Action Model (WAM)-controlled robot by modifying a small region of its visual input. This is an untargeted, test-time attack.
Attack Design and Implementation
The attack exploits the reuse of public visual encoders across WAMs with different downstream control architectures. The encoder output therefore provides an attack objective independent of a particular action interface. For local pixel changes to affect broader scene representations, they must exploit propagation pathways within the encoder.
We maximize the difference between the encoder’s clean and patched representations over the entire latent output, including all spatial positions and channels. The same patch is optimized over multiple source observations.
Experimental Setup
We conduct closed-loop evaluation on LIBERO and RoboTwin. LIBERO contains four task categories—Spatial, Object, Goal, and Long-horizon—with 10 tasks each. RoboTwin contains 50 tasks.
FastWAM is the default evaluation model. DreamWAM-uncond (DW-U), DreamWAM-joint (DW-J), and Motus are used for transfer evaluation within the same benchmark. Each model configuration retains its own action-generation process and preprocessing.
Mechanism and Behavioral Analysis
This section investigates how a local pixel change by TAPDreamer results in deviations in action execution. The analysis examines impacts on latent representations due to TAPDreamer.
Conclusion
TAPDreamer optimizes a fixed local patch using only a public visual encoder and six observations from one task, yet produces strong closed-loop interference across two complete benchmarks and different downstream action architectures. Mechanism analysis reveals that interactions between attention-weight and value changes broadcast local interference to distant representations, while optimized perturbation responses remain highly consistent across task observations.
Behavioral analysis connects this representation vulnerability to grasping and pose interference, and separates the immediate effects of sustained visual input from state consequences accumulated through execution. These results show that WAM robustness must cover the full path from local visual input through representation, generation, and control.
Ethics Statement
This study aims to identify vulnerabilities of World Action Models to local visual perturbations to inform robot safety evaluation and defense research. All experiments were conducted in the LIBERO and RoboTwin simulation environments, with attacks implemented by modifying model input images.
We recognize that such methods could be misused to disrupt normal robot operation and emphasize that their use should be restricted to authorized security testing and research. The mechanism analysis suggests potential defenses that attenuate keys and values from suspicious image regions or train the encoder to preserve representations outside locally perturbed regions. These interventions target the attention-mediated spread of the patch-induced shift; their effectiveness against adaptive attacks and their impact on clean-task performance remain to be evaluated.
Attention-Restoration Interventions
We measure the remaining change relative to the clean output, normalized by the change without restoration. For latent retention, both changes are measured using the L2 norm over the entire latent, including the patch footprint; action retention uses the corresponding L2 ratio for action outputs. The random patch is evaluated with the same latent-retention metric.
Because attention reconstruction uses a different numerical precision from model inference, the patched reference without restoration is computed through the same reconstruction pathway. These ratios measure retained changes, not task success rates.
All three interventions leave approximately 33% of the latent change and 32% of the action change induced by TAPDreamer. In comparison, random-patch latent retention remains approximately 1.000. Thus, restoring the attention branch, its weights, or its values removes most of the TAPDreamer-induced latent and action changes, while having little effect on the random patch.
Behavioral Effects
The preceding analyses show how patch-induced perturbations propagate through attention and how optimization establishes a shared direction before amplifying its magnitude. We now ask how these representation changes affect action commands and, in turn, lead to task failure.
The same representation shift can affect different actions as a task unfolds. The patch drives the end effector below its clean trajectory and prevents task completion. We use same-state action comparisons, internal restoration, and patch removal to connect the shift to commands and physical consequences.
Task: Put the alphabet soup and tomato sauce in the basket.
Frequently Asked Questions
What does TAPDreamer aim to do? It aims to reduce the task success rate of a WAM-controlled robot by modifying a small region of its visual input.
What information is needed to optimize the patch? TAPDreamer uses a public visual encoder and six observations from one task.
Which benchmarks are used for closed-loop evaluation? The evaluation uses LIBERO and RoboTwin.
What do the attention-restoration interventions show? They leave approximately 33% of TAPDreamer-induced latent change and 32% of action change, while random-patch latent retention remains approximately 1.000.