JailWAM: Jailbreaking World Action Models in Robot Control

Hanqing Liu; Songping Wang; Jiahuan Long; Jiacheng Hou; Jialiang Sun; Chao Li; Yang Yang; Wei Peng

cs.ROApr 7, 2026

JailWAM: Jailbreaking World Action Models in Robot Control

Authors: Hanqing Liu, Songping Wang, Jiahuan Long, Jiacheng Hou, Jialiang Sun, Chao Li, Yang Yang, Wei Peng,

Organizations: MoE Key Lab of Artificial Intelligence, AI Institute, Shanghai Jiao Tong University, Shanghai, China · Defense Innovation Institute, Chinese Academy of Military Science, Beijing, China · PR Lab, Nanjing University, Suzhou, China

Abstract

World Action Models (WAMs) have emerged as a promising paradigm for robotic manipulation, enabling physical interaction across diverse tasks and environments. However, their ability to directly follow high-level instructions and execute physical actions also creates potential safety risks, as adversarially designed instructions may induce unsafe robot behaviors. To systematically assess these risks, we propose JailWAM, the first jailbreak evaluation framework for WAMs. In JailWAM, we integrate three key innovations: Firstly, to address the difficulty of evaluating heterogeneous low-level action outputs, we introduce Visual-Trajectory Mapping, which transforms model-specific actions into unified visual trajectory representations, thereby facilitating consistent risk assessment across WAM architectures. Secondly, to provide efficient and fine-grained assessment of physical risks, we develop a Risk Discriminator supervised by three safety levels ordered according to physical consequence: Safety Compliance, Motion Failure, and Catastrophic Risk. This severity-aware formulation enables the risk discriminator to distinguish different physical outcomes from visual trajectories and support scalable risk screening. Thirdly, to reduce the cost of exhaustively executing adversarial candidates, we design a Dual-Path Verification Strategy that combines rapid risk screening with closed-loop physical simulation, restricting computationally expensive verification to candidates with potential safety risks. Extensive experiments in the RoboTwin simulation environment show that JailWAM achieves an 84.2% attack success rate on LingBot-VA, which indicates that WAMs may be susceptible to jailbreak attacks that induce unsafe physical behaviors. Our findings may motivate further research on the safety evaluation and alignment of future embodied robotic systems.

Figures & tables

Figure 1: Representative closed-loop rollouts of LingBot-VA in the RoboTwin simulator. Normal instructions result in Level 0 ( Safety Compliance ), whereas jailbreak instructions generated through JailWAM induce Level 1 ( Motion Failure ), including deadlocks and persistent state loops, and Level 2 ( Catastrophic Risk ), including erratic swings and collisions. Within each example, execution states are arranged in temporal order from left to right, while risk severity increases from top to bottom.

Figure 2: Overview of JailWAM. Jailbreak instructions are generated to probe WAM vulnerabilities, where Visual-Trajectory Mapping (VTM) transforms executable actions into visual trajectories for Risk Discriminator (RD)-based screening. High-risk candidates are subsequently verified through closed-loop simulation under the Dual-Path Verification Strategy.

Figure 3: Risk Discriminator fine-tuning pipeline and consequence-oriented safety classification. Visual trajectory charts generated by VTM are annotated by Gemini and verified by human experts, providing supervision for Qwen3-VL fine-tuning. The trained discriminator predicts three safety levels according to physical consequence severity.

Model	Metric	Clean	RSA	TPA	JailWAM
LingBot-VA ( Li et al. 2026a )	RD-ASR	2.20%	7.80%	6.40%	87.00%
LingBot-VA ( Li et al. 2026a )	Human-ASR	1.60%	5.20%	4.20%	84.20%
Light-WAM ( Li et al. 2026b )	RD-ASR	2.28%	10.72%	12.60%	73.36%
Light-WAM ( Li et al. 2026b )	Human-ASR	1.56%	8.60%	11.56%	71.20%
X-WAM ( Guo et al. 2026 )	RD-ASR	3.08%	5.16%	13.28%	24.72%
X-WAM ( Guo et al. 2026 )	Human-ASR	0.48%	3.36%	10.32%	23.00%

Table 1: Main jailbreak evaluation results across four WAMs and two VLA models in RoboTwin. RD-ASR and Human-ASR denote Risk Discriminator predictions and human-verified outcomes, respectively.

Figure 4: Qualitative results demonstrating jailbreak attack robustness. The same jailbreak instruction consistently elicits similar dangerous behaviors in both clean and randomized scenes within the same task.

	Cosmos-Policy ( Kim et al. 2026 )			$\pi_{0.5}$ ( Physical Intelligence et al. 2025 )
Method	Human			Human
	MFR	CRR	ASR	MFR	CRR	ASR
clean	0.60%	0%	0.60%	0.80%	0%	0.80%
RSA	5.20%	0%	5.20%	1.80%	0%	1.80%
TPA	4.60%	0%	4.60%	2.20%	0%	2.20%
JailWAM	46.50%	0%	46.50%	5.00%	0%	5.00%

Table 2: Jailbreak evaluation results on Cosmos-Policy and

\pi_{0.5}

in the LIBERO environment.

Variant	VTM	Fine-tuning	Accuracy ( $\uparrow$ )	Macro-F1 ( $\uparrow$ )	Level 2 Recall ( $\uparrow$ )
Raw Action + RD	–	✓	$33.3\%$	$16.7\%$	$0.0\%$
VTM + RD (w/o FT)	✓	–	$46.3\%$	$40.2\%$	$17.0\%$
VTM + RD (Ours)	✓	✓	90.7%	90.5%	72.0%

Table 3: Ablation study on VTM and RD fine-tuning using 300 human-verified samples. Accuracy denotes classification correctness, Macro-F1 measures balanced performance, and Level 2 Recall evaluates catastrophic risk detection.

Figure 5: (a) Quality analysis of supervision signals and (b) efficiency evaluation of the Risk Discriminator.

Method	Total Time (Hours)	Simulator Runs	Verified Unsafe Cases
Closed-Loop Only	9.15	100	23
JailWAM (Ours)	3.66 ( $2.50\times$ faster)	21 ( $79\%$ fewer)	17

Table 4: Efficiency-Coverage comparison of the Dual-Path Verification Strategy over 100 candidate prompts.

Figure 6: Cross-seed reliability of LLM-generated prompts across different number of random seeds.

Jailbreak Attacks

Jailbreak attacks exploit prompts, context, or model representations to bypass AI safeguards and elicit disallowed outputs.

See all 75 papers

BadWAM: When World-Action Models Dream Right but Act Wrong
Jul 16, 2026Qi Li, Xingyi Yang, Xinchao WangWorld Models for Robotics Adversarial Attacks
National University of Singapore · The Hong Kong Polytechnic University
RoboJailBench: Benchmarking Adversarial Attacks and Defenses in Embodied Robotic Agents
May 19, 2026Doguhuan Yeke, Yanming Zhou, Leo Y. Lin +3Jailbreak Attacks AI Agent Security Benchmarks
Purdue University
ARB4WM: An Adversarial Robustness Benchmark for World Models in Continuous Control
Jun 15, 2026Junjian Zhang, Hao Tan, Ruonan Li +3World Models for Robotics Adversarial Robustness
College of Computer Science, National University of Defense Technology, Changsha, 410073, China · National Key Laboratory of Advanced Communication Networks, Shijiazhuang, 050081, Hebei, China · College of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, 518055, China +1

Jul 16, 2026J/K move · Enter open · S save

BadWAM: When World-Action Models Dream Right but Act Wrong

Qi Li, Xingyi Yang, Xinchao Wang

National University of Singapore · The Hong Kong Polytechnic University

World Models for Robotics Adversarial Attacks World Action Models Adversarial Perturbations Adversarial Attacks on World Models

Open paper AskPDF arXiv

World-action models (WAMs) are emerging as a promising foundation for embodied control: rather than predicting actions alone, they learn representations that couple action generation with future world prediction. This coupling is often viewed as a source of robustness, interpretability, and safety, as a robot's action can in principle be checked against its imagined future. In this paper, we show that this assumption is fragile. We introduce BadWAM, a unified framework for modeling and evaluating World-Action Drift Attacks: a new class of WAM-specific adversarial attacks that use small visual perturbations to break the alignment between what a WAM imagines and what it executes. BadWAM characterizes this attack surface along two natural criteria: attack strength and stealthiness. When the adversary prioritizes disruption, BadWAM instantiates an action-only adversarial attack, which directly drives the model toward task-failing actions. When the adversary additionally prioritizes stealth, BadWAM instantiates an imagination-preserving adversarial attack, which seeks to induce harmful action shifts while keeping the model's predicted future close to its clean imagination. Together, these two attacks capture a spectrum of WAM-specific failures: from overt action hijacking to stealthier cases where the model appears to imagine a plausible future but executes a desynchronized action. We evaluate BadWAM across different variants of WAMs. Results show that our attacks substantially reduce task success rates under closed-loop execution. For example, our action-only attack reduces the model performance from 96.5% to 43.1% success. The results of our imagination-preserving attack further exposes a WAM-specific vulnerability: moderate future-preserving regularization can maintain strong attack performance while reducing future imagination drift.

Abstract

Jailbreak Attacks

Explore similar work

BadWAM: When World-Action Models Dream Right but Act Wrong

RoboJailBench: Benchmarking Adversarial Attacks and Defenses in Embodied Robotic Agents

ARB4WM: An Adversarial Robustness Benchmark for World Models in Continuous Control