Generative world models (WMs) are increasingly used to synthesize controllable, sensor-conditioned driving videos, yet their reliance on physical priors exposes novel attack surfaces. In this paper, we present Physical-Conditioned World Model Attack (PhysCond-WMA), the first white-box world model attack that perturbs physical-condition channels, such as HDMap embeddings and 3D-box features, to induce semantic, logic, or decision-level distortion while preserving perceptual fidelity. PhysCond-WMA is optimized in two stages: (1) a quality-preserving guidance stage that constrains reverse-diffusion loss below a calibrated threshold, and (2) a momentum-guided denoising stage that accumulates target-aligned gradients along the denoising trajectory for stable, temporally coherent semantic shifts. Extensive experimental results demonstrate that our approach remains effective while increasing FID by about 9% on average and FVD by about 3.9% on average. Under the targeted attack setting, the attack success rate (ASR) reaches 0.55. Downstream studies further show tangible risk, which using attacked videos for training decreases 3D detection performance by about 4%, and worsens open-loop planning performance by about 20%. These findings has for the first time revealed and quantified security vulnerabilities in generative world models, driving more comprehensive security checkers.
Figures & tables
Figure 1: Adversarial attack on generative world model. By conducting white-box attacks on the generative world model, we aim to change the semantics of the generated results while preserving quality, thus achieving an adversarial attack that affects downstream tasks
Figure 2: Overall framework of PhysCond-WMA.
Figure 3: Visualization of untargeted and targeted PhysCond-WMA
Model
DriveDreamer [ 53 ]
DriveDreamer2 [ 66 ]
FID ↓
FVD ↓
ASR(GPT-5) ↑
ASR(Human) ↑
FID ↓
FVD ↓
ASR(GPT-5) ↑
ASR(Human) ↑
Clean
52.6
452.0
-
-
18.4
74.9
-
-
Untargeted Attack
54.9
481.6
0.12
0.25
21.6
77.3
0.18
0.32
Targeted Attack
54.1
474.3
0.19
0.41
20.5
75.7
0.30
0.55
Table 1: Performance of PhysCond-WMA on different World Models
Figure 4: Visualization of PhysCond-WMA. GPT-5 determines attack failure, while human determines attack success.
Dataset
DriveDreamer [ 53 ]
DriveDreamer2 [ 66 ]
mAP ↑
NDS ↑
mAP ↑
NDS ↑
w/o clean synthetic data
30.2
38.1
-
-
w clean synthetic data
30.9
38.3
31.7
43.5
w attacked synthetic data
29.8
37.6
30.4
41.6
Table 2: Performance of 3D object detection with different synthetic data augmentation.
Method
L2 Avg.(m) ↓
Col.(%) ↓
ST-P3 [ 23 ]
2.11
0.71
VAD [ 24 ]
0.37
0.14
Drivedreamer [ 53 ]
0.29
0.15
PhysCond-WMA
0.33
0.19
Table 3: Performance of Open-loop planning on nuScenes validation set. The evaluation settings are the same as ST-P3.
Figure 5: Ablation study on loss function threshold τ
Model
Untargeted Attack
Targeted Attack
FVD ↓
ASR(Human) ↑
FVD ↓
ASR(Human) ↑
Stage 1 Only
85.4
0.04
85.1
0.03
Stage 2 Only
96.9
0.06
105.0
0.11
Our Method
77.3
0.32
75.7
0.55
Table 4: Ablation study of attack stage.
Figure 6: Visualization of ablation study of attack stage.
Model
Untargeted Attack
Targeted Attack
FVD ↓
ASR(Human) ↑
FVD ↓
ASR(Human) ↑
HDMap
76.9
0.21
77.1
0.40
3D BOX
78.1
0.25
76.4
0.39
Our Method
77.3
0.32
75.7
0.55
Table 5: Ablation study of Physical condition on PC-WMA
Figure 7: Visualization of ablation study of physical condition.
Figure 8: Visualization of target generation.
Figure 9: The prompt of ASR(GPT) Evaluator.
Figure 10: The survey questionnaire of ASR(Human) Evaluator.