Where World Models Break: Natural-Input Failure Discovery

Zhanpeng Shi; Zi Liang; Rong Feng; Shiqin Tang; Xuyang Chen; Hongzong Li

cs.AIAug 23, 2026

Where World Models Break: Natural-Input Failure Discovery

Authors: Zhanpeng Shi, Zi Liang, Rong Feng, Shiqin Tang, Xuyang Chen, Hongzong Li

Organizations: School of Computer Science, Northwestern Polytechnical University · The Hong Kong Polytechnic University · Department of Data Science, City University of Hong Kong · Centre for Artificial Intelligence and Robotics, Hong Kong Institute of Science & Innovation, Chinese Academy of Sciences · Department of Electrical and Computer Engineering, National University of Singapore · Generative AI Research and Development Center, The Hong Kong University of Science and Technology

Abstract

World models predict action-conditioned futures and serve as critical internal simulators for downstream planning and control. However, catastrophic prediction failures of world models could dangerously propagate through the control pipeline, as subsequent agent or model training and decision-making depend heavily on the continuous environment evolution forecasted by these world models. Existing evaluations overlook this systemic risk: by aggregating average errors over benign generations from general queries, they fail to stress-test the model against catastrophic collapses under rare or unobserved condition-action combinations. To bridge this gap, we formalize the natural-input failure discovery problem: under a finite query budget, finding environment-valid conditions and action prefixes that induce severe prediction risk, verifying whether these failures reproduce on fresh seeds, and testing their persistence under nearby valid edits. Discovering such critical failures is computationally challenging, as valid condition-action combinations explode exponentially, rendering exhaustive search or standard sampling infeasible given the high cost of noisy rollouts. To tackle this, we propose BasinLens, which exploits the underlying structure of valid inputs, where each coordinate possesses environment-defined semantic types and admissible domains, by pairing uncertainty-guided global search with typed local replacements. Across diverse benchmarks and world-model families, BasinLens exposes reproducible and locally persistent failure modes that conventional evaluations fail to reveal, showing that average-case benchmarks can mask important vulnerabilities in world-model-driven control.

Figures & tables

Figure 1: Problem, structured search, and independent evidence. Aggregate evaluation can miss a small region of legal inputs (left). BasinLens represents legal conditions as typed coordinates, maintains the evaluated set, forms global-surrogate and typed-frontier proposal pools, and queries their merged acquisition until returning a finite-budget discovery record (center). Held-out-seed re-evaluation and fresh radius-1 legal neighborhoods test reproducibility and local persistence without feeding validation evidence back into search (right).

Question	Library / budget	Independent record
Discovery	12,016; $B\in\{16,32,64\}$	Search score, fixed-threshold hit, and mean best score
Held-out	576; $B=32$	Selected points on 16 disjoint seeds
Local	3,510; $B=32$	Fresh radius-1 neighborhoods around top, mid, and random anchors
Components	Cached grids; other interfaces	Common-scout hit or coverage; no cross-interface scale pooling

Table 1: Protocol map. Each row answers a different question; measurements are not pooled across rows.

Figure 2: Discovery and structure-sensitive search evidence. (A) Cumulative probability of crossing

R_{\mathrm{eval}}\geq 1.60

on the 12,016-candidate large online grid. (B) Mean best search score at budget 32 on the 3,510-candidate wide validation grid. (C) Cached budget-32 hit rates for the top

2\%

of the single-factor grid and top

5\%

of the combinatorial grid: GP-UCB leads in the former, whereas the interaction-aware and beam variants lead in the latter. (D) With block and goal fixed, changing only the valid agent start increases the predicted final block–goal distance ratio; higher is worse.

Figure 3: Independent validation and measurement boundary. (A) BasinLens -selected inputs retain higher mean prediction conditional value at risk (CVaR) on held-out seeds than the default-reset reference. (B) Fresh radius-1 neighborhoods around top-score anchors have higher mean prediction CVaR than neighborhoods around mid-score and random controls, supporting local persistence. (C) In a deterministic TwoRooms case, changing only the valid start raises future-position mean absolute error (MAE) from

13.2

89.0

pixels. (D) Probe MAE changes only from

1.13

1.66

pixels in the same case; readout error alone therefore does not explain the forecast error. Panels C and D use different vertical scales.

Paradigm	Typical output
Aggregate benchmarks	Aggregate performance over sampled rollouts
Adversarial testing	High-loss cases under optimized perturbations or conditions
Policy stress testing	Policy failures in valid scenarios
Scenario falsification	Counterexamples to stated requirements
Black-box optimization	Best queried inputs for scalar objectives
This work	Environment-valid triggers with held-out point and legal-neighborhood evidence

Table 2: Positioning relative to adjacent evaluation settings. Individual methods may combine multiple elements.

Appendix figures & tables34 assets

Supplementary material from the paper’s appendix.

Appendix

Question	Model/task	Valid-input library	Query setting	Evidence returned
Discovery	LeWM PushT	Large online grid (12,016)	$B=16,32,64$ ; 64 restarts	Best search score and threshold crossing under matched budgets
Point validation	LeWM PushT	Point-validation library (576)	$B=32$ ; pooled 128 restarts	Shortlisted points reevaluated on 16 disjoint seeds
Local persistence	LeWM PushT	Wide validation grid (3,510)	$B=32$ ; two seed splits	Fresh radius-1 neighborhoods around top, mid-score, and random anchors
Component isolation	LeWM PushT	Cached combinatorial grid (431)	$B=8,16,32$ ; 512 restarts	Top-set hit rate for global, frontier, interaction, and beam variants
Replication	DINO-WM PushT	512 and 384 geometries	$B=32$ ; 128 paired replays	Point discovery and reference-component coverage after a common scout
Interface scope	JEPA-WM/Atari	480/128/36 valid inputs	Protocol-specific budgets	Latent-feature or future-frame prediction-risk discovery

Appendix

Table A.1: Protocol map. Candidate libraries, seed partitions, and measurements are intentionally distinct because each row answers a different question. Core claims do not combine unmatched protocols into a single statistic.

Figure B.1: Detailed natural-input failure-discovery workflow. Left: one legal typed input is executed in the environment and the frozen world model, producing a prediction-risk observation. Center: active search alternates global refreshes with typed moves around evaluated high-risk inputs while querying only members of the legal input set. Right: returned inputs are ranked and evaluated using held-out seeds and nearby legal changes. The orange contours are a schematic risk landscape, not an oracle surface available to the search algorithm.

Parameter	LeWM PushT	DINO-WM PushT
Scout size $b_{0}$	3	8
UCB exploration coefficient $\beta$	0.35	0.45
Number of anchors	4	4
Global-pool size	16	24
Parent weight $\lambda_{p}$	0.10	0.10
Proximity weight $\lambda_{d}$	0.08	0.12

Appendix

Table C.1: Parameters used by the LeWM online protocols and the DINO-WM common-scout replay.

Model/task	Typed natural input	Validity rule	Prediction-risk interface
LeWM PushT	Agent, block, and goal $x/y$ coordinates	Candidate must instantiate a simulator reset and satisfy the protocol’s minimum agent–block and block–goal distances	Upper-tail CVaR of final-step state-probe MSE
LeWM TwoRooms	Agent start $x/y$ with fixed target	Start lies in navigable free space under the fixed room geometry	Predicted-future position MAE and target-distance gap
DINO-WM PushT	Agent, block, and goal $x/y$ coordinates	Simulator-valid reset with minimum geometry distances	Upper-tail CVaR of final-step visual-feature MSE
DINO-WM Wall	Start, goal, and opening geometry	Simulator-valid local configuration with a matched environment rollout	Decoded-path discrepancy and visible crossing outcome
JEPA-WM PointMaze	Reset seed, action template, and scale	Scaled actions remain in $[-1,1]^{2}$ and use the fixed action horizon	Visual-latent MSE plus $0.1$ proprioceptive-latent MSE
DIAMOND Atari	Reset seed and four discrete prefix actions	Every prefix entry belongs to the game’s action set	One-step future-frame MSE

Appendix

Table D.1: Typed input specifications and model-specific prediction risks. A local replacement changes one listed input field and retains the candidate only if the corresponding validity rule still holds.

Protocol	Restart seeds	Search-evaluation seeds	Point-validation seeds	Neighborhood seeds	Notes
576-candidate search	32–127	0–7	–	–	Scout size three; budget 32
576-candidate pooled validation	0–127	0–7	16–31	–	96 runs use scout size three and 32 use scout size four; 24 of 27 unique BasinLens selections have complete held-out measurements
3,510-candidate split A	192–255	0–7	32–47	48–63	Budget 32; point and radius-1 neighborhood records are kept separate
3,510-candidate split B	256–383	16–23	80–95	96–111	Independent restart and environment-seed split; budget 32
12,016-candidate discovery	384–447	24–31	–	–	Budgets 16, 32, and 64

Appendix

Table D.2: Seed ledger for the principal LeWM PushT protocols. A dash indicates that the corresponding follow-up evaluation is not part of that protocol.

Term	Symbol or endpoint	Definition	Permitted interpretation
Prediction risk	$R_{\mathrm{pred}}$ or $R_{\mathrm{val}}$	Aggregate discrepancy between world-model predictions and matched environment futures	Prediction quality under the specified model interface and seed set
Search score	$R_{\mathrm{eval}}$	Prediction risk minus a prespecified task-activity penalty	Acquisition and shortlist ranking; equal to prediction risk only for task-active candidates
Task consequence	Environment progress	Closed-loop block–goal progress under a controller	Outcome of the controller protocol; not another prediction-risk measurement

Appendix

Table D.3: Terminology used throughout the paper. Prediction risk, search score, and task consequence are distinct quantities and are not substituted for one another.

Model	Task	Target	Unit	MAE $\downarrow$	$N$
LeWM	PushT	Agent position	px	19.64	48
LeWM	PushT	Block position	px	8.90	48
LeWM	PushT	Block angle	deg	3.84	48
LeWM	TwoRooms	Agent position	px	1.55	11

Appendix

Table D.4: Held-out probe checks for LeWM tasks without native RGB decoding. MAE denotes mean absolute error, px denotes pixels, deg denotes degrees, and

N

is the number of held-out samples; lower is better.

Figure D.1: LeWM PushT probe diagnostic under fixed block–goal geometry. The left panel shows the historical legal-start scan; the upper and lower strips compare a lower-score and a higher-score start for one representative seed; and the lower-right plot shows physical distances decoded from the predicted latent sequence. The listed held-out probe errors are measured on environment-encoded latents. This figure is illustrative and is not counted as an additional statistical sample.

Method	Selected unique	Validated	Mean CVaR	Task-active	Contacts	Block path
Random	46	39	1.292	1.000	10.05	93.18
GP-UCB	34	30	1.278	0.900	10.61	88.06
BasinLens	27	24	1.311	0.958	11.58	94.59

Appendix

Table D.5: Method-specific held-out summary for the 576-candidate protocol. Selected unique counts are deduplicated candidates returned under the per-run validation caps; Validated counts have complete measurements on the 16 disjoint seeds. Contacts and block path are validation-seed averages, with block path measured in pixels. Because methods produce different candidate sets and validation availability, this table is descriptive rather than a paired search-performance comparison.

$B$	Method	Mean $\pm$ SEM	$p_{R}$	$p_{G}$
16	Random	$1.368{\pm}0.017$	–	–
	GP-UCB	$1.370{\pm}0.027$	–	–
	BasinLens	$\mathbf{1.411{\pm}0.023}$	0.0056	0.295
32	Random	$1.444{\pm}0.014$	–	–
	GP-UCB	$1.481{\pm}0.020$	–	–
	BasinLens	$\mathbf{1.493{\pm}0.018}$	0.0011	0.175

Appendix

Table E.1: Mean best search score on the 12,016-candidate PushT grid across 64 paired restarts (mean

\pm

standard error of the mean (SEM); higher is better).

p_{R}

and

p_{G}

compare BasinLens with random search and Gaussian-process upper confidence bound (GP-UCB) search.

$B$	Method	Hit rate	BasinLens gain	Paired $p$
16	Random	0.056	0.117	$7.2\times 10^{-4}$
	GP-UCB	0.148	0.024	0.229
	BasinLens	0.173	–	–
32	Random	0.135	0.188	$7.0\times 10^{-4}$
	GP-UCB	0.298	0.025	0.140
	BasinLens	0.323	–	–

Appendix

Table E.2: Threshold-averaged hit rate on the 12,016-candidate large online PushT grid (higher is better).

B

is the query budget. Each score averages 16 hit indicators over

R_{\mathrm{eval}}\in[1.50,1.65]

in increments of 0.01. On a comparator row, BasinLens gain is BasinLens minus that method, and paired

p

is the corresponding one-sided exact paired sign-test value.

$B$	Threshold	Random	GP-UCB	BasinLens	Gain R	$p_{R}$	$p_{G}$
16	$R\geq 1.55$	0.078	0.172	0.219	2.8 $\times$	0.011	0.274
16	$R\geq 1.60$	0.016	0.094	0.062	4.0 $\times$	0.188	0.855
16	$R\geq 1.62$	0.016	0.031	0.047	3.0 $\times$	0.312	0.500
32	$R\geq 1.55$	0.188	0.422	0.438	2.3 $\times$	0.003	0.500
32	$R\geq 1.60$	0.047	0.234	0.203	4.3 $\times$	0.011	0.760
32	$R\geq 1.62$	0.031	0.078	0.109	3.5 $\times$	0.090	0.377

Appendix

Table E.3: Prespecified threshold-crossing rates on the 12,016-candidate grid.

B

denotes query budget, Gain R is the ratio of BasinLens and random-search hit rates, and

p_{R}/p_{G}

are one-sided paired values against random search and GP-UCB. Reporting several thresholds prevents the discovery conclusion from depending on the single headline cutoff.

$B$	Random	GP-UCB	BasinLens	Gain R	$p_{R}$	Gain G	$p_{G}$
16	16.89	16.58	16.67	0.22	0.188	-0.09	0.746
32	32.33	30.00	30.52	1.81	0.011	-0.52	0.798
64	61.27	51.69	49.69	11.58	$2.4\times 10^{-6}$	2.00	0.087

Appendix

Table E.4: Mean capped first-hit step for search score at least

1.60

on the largest PushT grid; lower is better. A run that does not cross the threshold is assigned one step beyond its budget. Gain columns are comparator minus BasinLens , so positive values favor BasinLens .

Figure E.1: Cumulative fraction of paired restarts that have discovered search score at least $1.60$ after each query on the 12,016-candidate PushT grid. The endpoint values are $0.547$ for BasinLens , $0.406$ for GP-UCB, and $0.109$ for random search.

Split	Random	GP-UCB	BasinLens	$p_{R}$	$p_{G}$
A	1.388	1.393	1.433	$7.81{\times}10^{-4}$	0.052
B	1.587	1.620	1.647	$4.81{\times}10^{-9}$	0.010

Appendix

Table E.5: Budget-32 best-search-score replication on two independent, non-overlapping seed splits of the same 3,510-candidate library (higher is better). Splits A and B use 64 and 128 paired restarts.

p_{R}

and

p_{G}

compare BasinLens with random search and GP-UCB.

Split	Random	Mid-score	Top	$p_{R}$	$p_{M}$
A	0.648	0.653	0.997	0.00458	0.00117
B	0.546	0.608	1.252	$6.99{\times}10^{-4}$	$7.77{\times}10^{-5}$

Appendix

Table E.6: Fresh radius-1 neighborhood conditional value at risk (CVaR) around BasinLens top-score anchors on the same two wide-grid splits (higher indicates greater prediction risk).

p_{R}

and

p_{M}

compare these neighborhoods with random-control and mid-score-control neighborhoods; this table does not compare BasinLens neighborhoods with GP-UCB neighborhoods.

Protocol	Endpoint	Comparator	Comp.	BasinLens	$\Delta$	W/L/T	$p$
Online 6D, $B=32$	Mean best $R$	Random	1.368	1.415	+0.047	67/27/2	$2.25{\times}10^{-5}$
Online 6D, $B=32$	Mean best $R$	GP-UCB	1.375	1.415	+0.040	47/23/26	0.0028
Wide 3,510, $B=32$	Mean best $R$	Random	1.587	1.647	+0.060	95/31/2	$4.81{\times}10^{-9}$
Wide 3,510, $B=32$	Mean best $R$	GP-UCB	1.620	1.647	+0.027	66/41/21	0.010
Large 12,016, $B=64$	Mean best $R$	Random	1.512	1.572	+0.060	49/14/1	$5.56{\times}10^{-6}$
Large 12,016, $B=64$	Mean best $R$	GP-UCB	1.547	1.572	+0.025	37/16/11	0.0027

Appendix

Table F.1: Consolidated online LeWM PushT endpoints from existing run-level records. Comp. is the named comparator,

\Delta

is BasinLens minus that comparator, and W/L/T gives paired wins, losses, and ties. Rows remain protocol-specific and are not averaged across candidate libraries.

Figure G.1: TwoRooms case with a fixed target and two valid agent starts. The top panel compares matched environment frames with nearest-neighbor visual proxies for predicted future states. The lower curve maps requested future time to the retrieved prediction time. The selected high-error start (red) collapses to nearly the same predicted state after the early horizon, whereas the reference start (green) continues to track the requested future.

Figure G.2: Illustrative DINO-WM PushT discovery record. Each large strip shows decoded world-model futures at five-step intervals, and each small strip shows the matched environment rollout. The lower legal input, $A=(289,248)$ , was returned with higher visual-feature prediction risk than the displayed comparison input, $A=(245,291)$ . This case illustrates the content of a returned record and is not an additional independent search trial.

Figure G.3: Four valid DINO-WM Wall configurations from the shifted local library. Black shows the matched environment rollout and orange the decoded world-model future. In each case, the environment trajectory passes through the opening while the predicted future remains on the original side. The gap labels denote the opening widths in pixels.

Figure G.4: PushT temporal comparison under fixed block–goal geometry. Each pair of rows shows the matched environment rollout and nearest-neighbor visual proxies for the predicted future. The selected start $A=(96,56)$ has the largest displayed final-step MSE and repeatedly maps later target times to the same early predicted state. The comparison starts show lower error and more temporal variation.

Case family	Legal factor varied	Observed prediction pattern	Evidence boundary
LeWM TwoRooms	Agent start with fixed target	Predicted position stops advancing and later requested times retrieve nearly the same early state	Deterministic paired visualization; not a frequency estimate over all navigation layouts
LeWM PushT	Agent start with fixed block and goal	Later target times repeatedly map to an early state while the matched rollout continues moving the block	Illustrated case; independent held-out and neighborhood tables support repeatability at the protocol level
DINO-WM PushT	Legal agent, block, and goal geometry	Decoded future diverges from the active matched rollout and yields elevated visual-feature error	Illustrative returned record; quantitative search evidence comes from the paired replay tables
DINO-WM Wall	Start, goal, and opening geometry	Environment trajectory crosses the opening while the decoded prediction remains on the original side	92 visible no-cross cases in the prioritized 900-input shifted library; not a distribution-wide prevalence claim

Appendix

Table G.1: Qualitative characterization of discovered legal-input failures. The cases explain what fails while keeping each conclusion attached to the protocol that produced it.

Protocol	Endpoint	Control	Control value	Selected	$\Delta$	Evidence
Fixed PushT	Final BG ratio	Reference start	0.941	1.110	+0.169	Higher in 98.4% of 64 pairs
Held-out point	CVaR	Default reset	1.186	1.311	+0.125	24 reevaluated cases
Wide-grid local	Radius-1 CVaR	Random controls	0.546	1.252	+0.706	$p=6.99{\times}10^{-4}$
Wide-grid local	Radius-1 CVaR	Mid-score controls	0.608	1.252	+0.644	$p=7.77{\times}10^{-5}$

Appendix

Table H.1: Fixed-case, held-out point, and fresh-neighborhood evidence. BG denotes block–goal and CVaR denotes conditional value at risk. For the BG ratio, higher means less predicted task progress; for CVaR, higher means greater prediction risk. Here,

\Delta

is Selected minus Control.

Protocol	Context group	Model-ranked	Env.-oracle-ranked	$\Delta$	W/L/T	$p$
MPC, 16 proposal seeds	Selected	-0.080	0.445	+0.525	30/2/0	$1.23{\times}10^{-7}$
Stratified MPC	Top held-out risk	-0.100	0.344	+0.443	29/3/0	$1.28{\times}10^{-6}$
Stratified MPC	Mid-control	0.061	0.532	+0.471	29/3/0	$1.28{\times}10^{-6}$
Stratified MPC	Random-control	0.045	0.373	+0.328	28/4/0	$9.65{\times}10^{-6}$

Appendix

Table H.2: Seed-matched model predictive control (MPC) results. At every replan, the model-ranked and environment-oracle-ranked controllers use the same proposal-seed set and state-conditioned proposal generator; higher environment-side progress is better. Here,

\Delta

is environment-oracle-ranked minus model-ranked progress. W/L/T denotes paired wins/losses/ties for Oracle versus Model, and

p

is the one-sided exact sign-test value.

Seeds	Model	Oracle	Random	Gap	Paired evidence
8	-0.107	0.253	-0.072	0.360	24/32 wins; $p=0.0035$ ; 11 sign reversals
16	-0.080	0.445	-0.274	0.525	30/32 wins; $p=1.23{\times}10^{-7}$ ; 16 sign reversals

Appendix

Table H.3: MPC sensitivity to proposal-seed set size. Model, Oracle, and Random are environment-side progress under the model-ranked, environment-oracle-ranked, and random controllers. Gap is Oracle minus Model; higher progress is better. Paired evidence reports Oracle wins, the one-sided exact sign-test value, and the number of negative-to-positive sign reversals.

Method	Hit@8 $\uparrow$	Hit@16 $\uparrow$	Hit@32 $\uparrow$
Random	0.361	0.562	0.828
GP-UCB	0.475	0.689	0.801
CEM	0.326	0.572	0.811
BasinLens-Frontier	0.287	0.527	0.773
BasinLens	0.455	0.672	0.803
BasinLens-Interaction	0.512	0.869	0.961

Appendix

Table J.1: Top-5% hit rate on the 431-candidate cached combinatorial grid across query budgets and 512 paired restarts. CEM denotes the cross-entropy method. For BasinLens-Interaction / BasinLens-Beam versus GP-UCB, one-sided exact sign-test values are

0.083/0.472

at budget 8,

1.81{\times}10^{-16}/2.10{\times}10^{-9}

at budget 16, and

7.32{\times}10^{-17}/8.77{\times}10^{-20}

at budget 32.

$N$	Top	Method	Best score $\uparrow$	Top count $\uparrow$	Comp. $\uparrow$	Hit $\uparrow$
512	5%	Random	2.712	1.594	0.984	0.812
		GP-UCB	2.863	5.617	3.195	1.000
		BasinLens-Frontier	2.849	5.781	4.914	0.906
		BasinLens	2.908	7.023	4.898	1.000
384	5%	Random	2.748	1.688	1.148	0.828
		GP-UCB	2.845	4.062	3.180	0.977

Appendix

Table J.2: DINO World Model (DINO-WM) PushT common-scout replication on independent 512- and 384-candidate libraries.

N

is the candidate-library size. Every method receives the same eight random scout points and a total budget of 32. Best score measures point discovery; Top count is the mean number of evaluated nodes in the prespecified top-score set; Comp. is the mean reference-component coverage

C_{q}

; and Hit is the fraction of runs that evaluate at least one top-score candidate. Higher is better.

Library	Outcome	$\Delta_{G}$	$p_{G}$	$\Delta_{F}$	$p_{F}$
512 candidates	Best score	0.045	$3.1{\times}10^{-4}$	–	–
	Comp. cov.	1.703	$1.1{\times}10^{-14}$	-0.016	0.929
384 candidates	Best score	0.013	0.006	–	–
	Comp. cov.	1.016	$6.9{\times}10^{-6}$	-0.148	0.988

Appendix

Table J.3: Paired DINO-WM top-5% comparisons for BasinLens . Comp. denotes reference-component coverage,

\Delta_{G}=\textsc{BasinLens}{}-\mathrm{GP\text{-}UCB}

, and

\Delta_{F}=\textsc{BasinLens}{}-\textsc{BasinLens-Frontier}{}

. Each

p

entry is the corresponding one-sided exact sign-test value. The frontier-only variant has slightly higher mean component coverage in both libraries.

$(B,S)$	Top	Best score	$\Delta_{G}$
$(16,8)$	10%	2.738	0.008
$(16,8)$	5%	2.738	0.008
$(32,4)$	10%	2.880	0.024
$(32,4)$	5%	2.880	0.024
$(32,8)$	10%	2.908	0.045
$(32,8)$	5%	2.908	0.045

Appendix

Table J.4: DINO-WM sensitivity over total query budget

B

and scout size

S

. Comp. denotes reference-component coverage,

\Delta_{G}=\textsc{BasinLens}{}-\mathrm{GP\text{-}UCB}

, and

\Delta_{F}=\textsc{BasinLens}{}-\textsc{BasinLens-Frontier}{}

. The upper panel reports point discovery; the lower panel reports component coverage, with

p_{G}

giving the one-sided exact sign-test value for the comparison with GP-UCB.

Model, case, and metric	$B/N$	Random	UCB	Structured	Paired $p$
LeWM PushT 6D, best search score	32/3510	1.587	1.620	1.647	$4.81{\times}10^{-9}$ /0.010
DIAMOND Breakout, best MSE ( $\times 10^{-4}$ )	16/128	1.6930	2.3203	1.8154	1.000/1.000
DIAMOND Pong, best MSE ( $\times 10^{-4}$ )	16/128	2.3478	2.0902	2.2117	0.500/1.000
IRIS Breakout, best MSE ( $\times 10^{-5}$ )	6/36	1.4400	1.4401	1.4400	–/1.000
IRIS Pong, best MSE ( $\times 10^{-4}$ )	6/36	1.1885	1.2057	1.0004	1.000/1.000
JEPA-WM PointMaze, composite latent risk	16/480	4.935	4.042	5.113	$8.55{\times}10^{-4}$ / $2.49{\times}10^{-8}$

Appendix

Table K.1: Cross-model search summary.

B/N

is query budget/library size. Structured denotes BasinLens for LeWM and the protocol-specific policies described in this section for the other models. The final column gives paired

p

values versus random/UCB; a dash marks an unavailable comparison. Higher is better, and bold marks the largest score in each row.

$B$	$N$	Method	Mean best risk	Top-5 hit	Top-10 hit	Top-10% hit
4	480	Random	3.635	0.016	0.031	0.281
		GP-UCB	3.449	0.008	0.016	0.203
		Structured	3.902	0.039	0.094	0.344
8	480	Random	4.281	0.062	0.133	0.555
		GP-UCB	3.655	0.008	0.047	0.414
		Structured	4.226	0.086	0.156	0.648

Appendix

Table K.2: JEPA-WM PointMaze budget sweep over 128 paired replay seeds. Higher is better for all columns because the objective is to discover inputs with higher prediction risk. The structured policy is strongest in mean best risk at budgets 4, 16, and 32; random search is slightly higher at budget 8, illustrating that method ordering depends on the available budget and risk landscape.

Record	Required fields	Verification supported
Candidate library	Stable identifier, typed input values, normalized representation, validity status	Candidate count, coordinate ranges, one-coordinate replacement graph
Evaluation record	Candidate identifier, environment seeds, per-seed losses, activity measurements, prediction risk, search score	Risk aggregation, activity adjustment, equality of cached values across methods
Search trace	Restart seed, ordered scout, ordered queries, acquisition values, top- $k$ output	Query budget, no repeated query, common-scout pairing, best-score and hit-rate summaries
Validation record	Selected identifier, disjoint validation seeds, per-seed losses, control identifier	Held-out point comparison without acquisition leakage
Neighborhood record	Anchor identifier, generated radius-1 identifiers, group label, fresh losses	Neighborhood validity, anchor-level aggregation, exact permutation test

Appendix

Table L.1: Minimal record schema for reproducing the reported discovery and validation results. Tables and figures are derived from these records rather than transcribed from console output.

Evidence type	Entry point	Primary record produced or consumed
LeWM PushT discovery	scripts/lewm_pusht_online_basin_gcg.py	Valid candidate library, per-candidate evaluations, and ordered search traces
Held-out point validation	scripts/validate_online_basin_candidates.py	Selected identifiers and disjoint-seed point-validation records
Fresh-neighborhood persistence	scripts/validate_online_widegrid_neighborhoods.py	Radius-1 candidate lists, fresh losses, and anchor-level summaries
Component isolation	scripts/combinatorial_basin_gcg_benchmark.py	Cached paired search traces for the global, frontier, interaction, and beam policies
LeWM state readout	scripts/lewm_pusht_state_probe_mainline.py	Probe checkpoint, held-out errors, and decoded state sequences
Controller consequence	scripts/lewm_pusht_closed_loop_mpc_audit.py	Seed-matched proposal rankings and environment-side controller outcomes

Appendix

Table L.2: Code-to-evidence map for the anonymous supplement. Each entry point accepts explicit upstream-repository and checkpoint paths rather than embedding machine-local locations.

Reporting item	Required content	Question answered
Input specification	Typed coordinates, allowed values, and environment-level validity checks	Is the discovered condition executable without an adversarial or off-support perturbation?
Prediction interface	Forecast origin and horizon, reference target, discrepancy, and seed aggregation	What exactly does “prediction failure” measure?
Discovery protocol	Candidate library, query budget, scout rule, comparator pairing, and search score	How was the case found, and were budgets comparable?
Selected case	Stable identifier, typed values, search score, prediction risk, and activity status	Can the reported condition be reconstructed and inspected?
Held-out evidence	Disjoint seeds, control definition, and candidate-level aggregation	Does elevated prediction risk reproduce beyond the search measurements?
Neighborhood evidence	Valid edit rule, radius, anchor groups, and fresh evaluation seeds	Does elevated risk persist under nearby valid changes?

Appendix

Table N.1: Reporting fields for natural-input failure discovery. The fields separate discovery efficiency from evidence about the returned condition.

Explore similar work

When the World Lies: Backdoor Attacks on Latent World Models for Downstream Control
Sep 14, 2026Roberto Riaño, Gorka Abad, Stjepan Picek +1Backdoor Attacks Latent World Models
Radboud University, The Netherlands · IKERLAN Technology Research Centre, Spain · University of Bergen, Norway +1
Hallucination in World Models is Predictable and Preventable
Jun 25, 2026Nicklas Hansen, Xiaolong WangWorld Model Learning World Models
1UC San Diego
World Models Dream of Success: Diagnosing and Repairing Failure Insensitivity in Robot World Models
Oct 6, 2026Jiuyi Xu, Xiao Hu, Meida Chen +3World Models for Robotics Action-Conditioned World Models
Colorado School of Mines · Northeastern University · Institute for Creative Technologies, University of Southern California +1

Sep 14, 2026J/K move · Enter open · S save

When the World Lies: Backdoor Attacks on Latent World Models for Downstream Control

Roberto Riaño, Gorka Abad, Stjepan Picek, Aitor Urbieta

Radboud University, The Netherlands · IKERLAN Technology Research Centre, Spain · University of Bergen, Norway+1

Backdoor Attacks Latent World Models

Open paper AskPDF arXiv

Pretrained world models, learned simulators that encode an observation into a latent state and predict how it evolves under actions, are beginning to be reused as off-the-shelf dynamics backbones for control, like pretrained encoders and language models are reused today. We show that this reuse opens a supply-chain backdoor: an adversary who controls only a released checkpoint can hijack the downstream controller, even though the victim trains and evaluates entirely on clean data and never sees the trigger. The attack encodes no explicit trigger-to-action rule. Instead, the poisoned model routes trigger-bearing observations into a chosen latent region and reshapes the local dynamics there, so that the victim's own optimization (Dreamer-style actor training in imagination, or MPC/CEM planning over predicted futures) re-discovers the attacker's target action on its own. Across several control tasks and trigger families, the trigger steers the controller's action toward the attacker's target, controlling every action dimension and hijacking 100% of triggered steps on the strongest settings. The checkpoint still passes the clean-data diagnostics a victim would run before deployment, with clean-task success retaining at least

\sim

75%. The effect is temporally gated: it appears only while the trigger is present and disappears when the trigger is removed. Trigger-blind repair is budget-dependent: moderate clean fine-tuning can preserve clean utility while leaving the triggered failure intact, whereas sufficiently aggressive adaptation can remove it only after substantially degrading clean control. The world-model backbone itself is therefore an emerging and underexamined attack surface for control. The full code and artifacts are available in our repository.

Abstract

Explore similar work

When the World Lies: Backdoor Attacks on Latent World Models for Downstream Control

Hallucination in World Models is Predictable and Preventable

World Models Dream of Success: Diagnosing and Repairing Failure Insensitivity in Robot World Models