World models increasingly serve as the predictive core of model-based reinforcement learning agents, enabling them to simulate future dynamics and reason over imagined trajectories before acting. Their substantial training demands make pretrained world models attractive for distribution and reuse, exposing downstream systems to model supply chain threats. Backdoor attacks offer a targeted and stealthy means of exploiting such supply chains, yet their threat to interactive world-model agents remains largely unexplored. To fill this gap, we present TrojanWorld, a backdoor framework for world-model agents that induces attacker-specified behavior by steering internal imagination. A physical object placed in the scene acts as the trigger, enabling deployment-time activation through the agent's native observation pipeline without digitally manipulating the observation stream. To achieve effective, stealthy, and persistent control, TrojanWorld combines Decision-Reflective Induction to steer trigger-conditioned imagination toward attacker-specified actions using decision feedback, Clean Behavior Anchoring to preserve trigger-free predictive and behavioral fidelity, and Causal Propagation to sustain the induced preference along subsequent trajectories after the trigger disappears. Together, these mechanisms establish an end-to-end attack chain from physical perception through corrupted imagination to malicious action selection. Experiments with the TD-MPC2, DreamerV3, and R2-Dreamer systems across the DeepMind Control, MetaWorld, MyoSuite, and RoboDesk benchmarks show that under trigger activation, TrojanWorld achieves a target-action deviation as low as 0.026 while retaining at least 98.8% of the corresponding clean performance. Even after trigger removal, the compromised agent can remain trapped in the induced behavioral trajectory, continuing to execute attacker-specified actions.
Figures & tables
Figure 1: Threat scenario and deployment workflow of TrojanWorld . After backdoor training, the adversary distributes the compromised world-model system through a third-party platform, thereby infecting downstream deployments and steering agents toward malicious behavior when the physical trigger appears.
Figure 2: Overview of TrojanWorld ’s backdoor training. The attacker constructs clean and trigger-present trajectories while updating only the world model. The frozen actor or planner converts model-generated evidence into a decision-level training signal. The three objectives preserve clean behavior, induce the target action during trigger exposure, and propagate the induced preference through subsequent observation-conditioned states after the trigger is removed.
DMC
MetaWorld
MyoSuite
RoboDesk
Method
CR ↑
TDR ↑
Win- E↓
Post- E↓
CR ↑
TDR ↑
Win- E↓
Post- E↓
CR ↑
TDR ↑
Win- E↓
Post- E↓
CR ↑
TDR ↑
Win- E↓
Post- E↓
Attacks on the DreamerV3 system
Vanilla
816.88
0.05
0.957
0.961
1675.95
10.00
0.914
0.889
808.74
0.00
1.028
1.032
381.73
5.00
1.168
1.154
Latent Poisoning
806.85
9.65
0.719
0.953
1691.96
55.00
0.568
0.992
810.57
15.00
0.982
1.086
388.56
5.00
1.100
1.095
Reward Attack
810.69
0.01
0.951
0.960
1613.64
5.56
0.743
0.771
810.80
0.00
1.019
1.030
383.23
0.00
1.112
1.092
BEAT
807.60
17.77
0.788
0.990
1677.91
15.00
0.637
1.304
791.29
50.00
0.967
1.074
393.46
21.67
0.660
1.222
Table 1: Attack effectiveness and clean utility on DreamerV3 and R2-Dreamer across four benchmarks. Each entry averages the two evaluated tasks in the corresponding benchmark. TDR is reported as a percentage. Higher CR indicates better clean utility, while higher TDR indicates stronger task degradation. Lower Win- E and Post- E indicate stronger target-action control during and after trigger exposure. Bold values mark the best attack result in each column.
Figure 3: Training dynamics for actor-based world model agent systems. The top and bottom rows report DreamerV3 and R2-Dreamer, respectively. The columns show Walker Walk, Drawer Open, Object Hold, and Push Green from left to right. Each panel reports Win- E with solid lines and TDR with dashed lines at 30K, 60K, 90K, 120K, and 150K training steps. Shaded bands show 95% episode-level bootstrap confidence intervals.
DMC
MetaWorld
RoboDesk
Method
CR ↑
TDR ↑
Win- E↓
Post- E↓
CR ↑
TDR ↑
Win- E↓
Post- E↓
CR ↑
TDR ↑
Win- E↓
Post- E↓
Attacks on the TD-MPC2 system
Vanilla
950.10
1.26
0.883
0.880
1667.13
0.00
0.752
0.775
312.81
0.00
1.024
1.029
Latent Poisoning
905.53
8.62
0.871
0.876
1695.85
0.00
0.738
0.741
306.37
0.00
1.016
1.022
Reward Attack
920.72
6.02
0.823
0.884
1637.70
18.75
0.982
0.795
288.20
0.00
0.906
1.025
BEAT
880.61
15.91
0.323
0.900
1696.94
11.11
0.316
1.001
382.62
16.67
0.218
1.120
Table 2: Attack effectiveness and clean utility on TD-MPC2 across three benchmarks. Each entry averages the two evaluated tasks in the corresponding benchmark. TDR is reported as a percentage. Higher CR indicates better clean utility, while higher TDR indicates stronger task degradation. Lower Win- E and Post- E indicate stronger target-action control during and after trigger exposure. Bold values mark the best attack result in each column.
Figure 4: Training dynamics for TD-MPC2 as a planning-based world model agent system. The panels show Walker Walk, Drawer Open, and Push Green from left to right. Each panel reports Win- E with solid lines and TDR with dashed lines at 30K, 60K, 90K, 120K, and 150K training steps. Shaded bands show 95% episode-level bootstrap confidence intervals.
Figure 5: Post-trigger target-action persistence on four DreamerV3 tasks. Each curve reports the cosine similarity between the executed action at and the target action a† , where higher values indicate stronger directional alignment. The shaded interval marks when the trigger is visible.
Defense
CR ↑
TDR (%) ↑
Win- E↓
Post- E↓
No Defense
654.40
50.28
0.0178
0.0076
Fine-Pruning (5%)
645.50
31.23
0.0253
0.3947
Fine-Pruning (15%)
614.00
28.29
0.0264
0.5341
SHINE
438.40
54.40
0.0179
0.0059
Neural Cleanse
652.90
50.38
0.0187
0.0068
Table 3: Robustness of TrojanWorld under defenses adapted to DreamerV3 on DMC Finger Spin. Higher CR indicates better clean utility. Higher TDR and lower Win- E and Post- E indicate greater retained attack effectiveness.
Lf
La
Lc
CR ↑
TDR (%) ↑
Win- E↓
Post- E↓
DreamerV3 on DMC Finger Spin
Vanilla
679.40
0.22
0.9230
0.9270
×
✓
✓
599.80
50.53
0.0199
0.0063
✓
×
✓
652.70
49.32
0.1168
0.0081
✓
✓
×
661.10
21.28
0.0183
0.7992
✓
✓
✓
663.10
50.23
0.0170
0.0078
Table 4: Contributions of the training objectives on two DreamerV3 tasks. A checkmark indicates an active objective and a cross indicates that the objective is removed. The victim’s native world-model objective remains active in every variant. TDR is reported as a percentage. Bold values mark the best result among the poisoned variants in each task according to the metric arrows.
Figure 6: Sensitivity to objective weights on R2-Dreamer Drawer Open. The left and right panels vary λa and λc , respectively. Across both sweeps, clean-return retention remains near 100%, TDR remains 100%, and Win- E and Post- E change only slightly.
Figure 7: Diagnostic decision-basin trajectories in two actor-based cases. The rows show DreamerV3 on DMC Finger Spin with K=80 and R2-Dreamer on MetaWorld Drawer Open with K=16 . Every target-action dimension is set to 0.5. The left panels project posterior states into two PCA dimensions and color the plane by an estimated target-action distance field E(z) . Markers correspond to Start, On − 1, On+1, Off+1, and Off+16, whose exact action-space distances are reported in the right panels. Each task uses the same rollout index across methods. The contour marks E=0.5 for visualization.
Figure 8: Activation selectivity on DreamerV3 Finger Spin. The horizontal axis reports FTR under trigger-free operation. Panels (a) and (b) report Win- E during trigger exposure and Post- E after trigger removal, respectively. The shaded region visualizes the joint criterion of FTR ≤0.05% and E≤0.10 . Only TrojanWorld satisfies both criteria in both panels.
Figure 9: From target-action control to task failure in two representative cases. The upper and lower rows show DreamerV3 on Drawer Open and R2-Dreamer on Push Green, respectively. The trigger is visible for 16% of each episode. Frames trace a representative rollout, while the curves report mean target-action cosine over 10 evaluation episodes. On Drawer Open, the induced action prevents task completion. On Push Green, it reverses an already successful outcome. In both cases, the resulting failure remains after trigger removal. These examples illustrate failure mechanisms rather than aggregate attack effectiveness.
Placement
TDR ↑
Win- E↓
Post- E↓
Win-cos ↑
Post-cos ↑
Δx=−2 cm
66.7
0.4441
0.4268
0.6553
0.6780
Δx=+2 cm
80.0
0.4662
0.3801
0.6527
0.7433
Δy=−2 cm
66.7
0.5068
0.4447
0.5998
0.6588
Δy=+2 cm
100.0
0.3624
0.2844
0.8075
0.9050
Trained (0,0)
100.0
0.3145
0.2501
0.8616
0.9447
Table 5: Sensitivity to trigger placement on R2-Dreamer Drawer Open. Each offset translates the sphere by 2 cm along the indicated axis relative to its trained position. TDR is reported as a percentage. Bold values mark a strictly best result according to the metric arrows.
Timing
TDR ↑
Win- E↓
Post- E↓
Win-cos ↑
Post-cos ↑
TD-MPC2 on DMC Finger Spin
Early
17.28
0.1288
1.0320
0.8904
−0.4149
Late
15.20
0.1674
N/A
0.8256
N/A
Full
99.81
0.0505
N/A
0.9830
N/A
Middle
17.88
0.1445
0.9015
0.8581
−0.1662
R2-Dreamer on MetaWorld Drawer Open
Table 6: Sensitivity to trigger timing. Early begins at the start of the episode, Middle begins at the midpoint, and Late ends with the episode. Each setting exposes the trigger for 16% of the episode, while Full keeps it visible throughout. N/A indicates that no post-removal interval remains. TDR is reported as a percentage. Bold values mark a strictly best result in each victim block.
World models enable long-horizon planning by internally generating and evaluating imagined trajectories, making them a promising foundation for generalist agents. However, this imagination-driven decision process also introduces new security risks. Existing backdoor attacks typically aim to manipulate local features, one-step predictions, or instantaneous policy outputs. While such objectives may suffice for weaker reactive models, they are often ineffective against world models, where the learned dynamics prior and planning process can absorb or wash out the effects of shallow perturbations. More importantly, we find that world models exhibit a distinct backdoor vulnerability rooted in the long-tailed ranking structure of imagined trajectories, where disrupting the ordering of a few decision-critical trajectories can systematically hijack planning. To exploit this vulnerability, we propose TRAP, a backdoor attack framework for world models that targets imagined trajectory ranking. TRAP combines a tail-aware ranking loss to focus optimization on decision-critical trajectories with dual gating mechanisms that stabilize optimization and regulate when and where the attack penalty is applied. Under trigger conditions, TRAP alters the relative ranking of imagined trajectories to redirect planning outcomes, while largely maintaining the normal ranking structure on clean inputs. Experiments on DreamerV3 and TD-MPC2 across diverse tasks show that TRAP consistently induces sustained behavioral deviations and significant performance degradation, highlighting the need for dedicated security evaluation of world-model-based agents.
Siyuan Duan, Ke Zhang, Xizhao Luo
Department of Computer Science and Technology, Soochow University Suzhou, China
Pretrained world models, learned simulators that encode an observation into a latent state and predict how it evolves under actions, are beginning to be reused as off-the-shelf dynamics backbones for control, like pretrained encoders and language models are reused today. We show that this reuse opens a supply-chain backdoor: an adversary who controls only a released checkpoint can hijack the downstream controller, even though the victim trains and evaluates entirely on clean data and never sees the trigger. The attack encodes no explicit trigger-to-action rule. Instead, the poisoned model routes trigger-bearing observations into a chosen latent region and reshapes the local dynamics there, so that the victim's own optimization (Dreamer-style actor training in imagination, or MPC/CEM planning over predicted futures) re-discovers the attacker's target action on its own. Across several control tasks and trigger families, the trigger steers the controller's action toward the attacker's target, controlling every action dimension and hijacking 100% of triggered steps on the strongest settings. The checkpoint still passes the clean-data diagnostics a victim would run before deployment, with clean-task success retaining at least ∼75%. The effect is temporally gated: it appears only while the trigger is present and disappears when the trigger is removed. Trigger-blind repair is budget-dependent: moderate clean fine-tuning can preserve clean utility while leaving the triggered failure intact, whereas sufficiently aggressive adaptation can remove it only after substantially degrading clean control. The world-model backbone itself is therefore an emerging and underexamined attack surface for control. The full code and artifacts are available in our repository.
Roberto Riaño, Gorka Abad, Stjepan Picek +1
Radboud University, The Netherlands · IKERLAN Technology Research Centre, Spain · University of Bergen, Norway +1
World models have recently seen a rapid growth in both their popularity and capability as more data efficient tools for generating robot training data or simulating real world environments, with many works proposing their integration into the robot learning pipeline. While highly practical, in this work we demonstrate that world models introduce a uniquely stealthy and effective data poisoning entry point into the robot learning supply chain that can result in the deployment of unsafe or otherwise compromised robotic policies despite training on seemingly safe ground truth training data. In contrast to traditional data poisoning techniques which directly implant dangerous trajectories into sold or uploaded datasets, our novel attack methods inject malicious prompts or compromising transition dynamics into visibly safe teleoperated datasets which are only activated once fed through a world model as input. This can result in the generation of synthetic, dangerous robot training trajectories and subsequently unsafe or compromised robot policies. We demonstrate the effectiveness of our attacks against both state of the art action conditioned and text conditioned world models, showing a full end-to-end backdoor on a downstream DRL policy and a proof-of-concept for the VLA setting. Overall these findings necessitate research into more secure world models and reevaluating their position within the robot learning supply chain.
Ethan Rathbun, Ahmed Agha, Saaduddin Mahmud +3
Northeastern University · University of Massachusetts Amherst