TrojanWorld: Backdooring World-Model Agents via Imagination Steering

Wenkai Huang; Siyuan Liang; Gaolei Li; Yiming Li; Tianhao Peng; Jianhua Li; Dacheng Tao

cs.LGSep 7, 2026

TrojanWorld: Backdooring World-Model Agents via Imagination Steering

Authors: Wenkai Huang, Siyuan Liang, Gaolei Li, Yiming Li, Tianhao Peng, Jianhua Li, Dacheng Tao

Organizations: Shanghai Jiao Tong University · Nanyang Technological University

Abstract

World models increasingly serve as the predictive core of model-based reinforcement learning agents, enabling them to simulate future dynamics and reason over imagined trajectories before acting. Their substantial training demands make pretrained world models attractive for distribution and reuse, exposing downstream systems to model supply chain threats. Backdoor attacks offer a targeted and stealthy means of exploiting such supply chains, yet their threat to interactive world-model agents remains largely unexplored. To fill this gap, we present TrojanWorld, a backdoor framework for world-model agents that induces attacker-specified behavior by steering internal imagination. A physical object placed in the scene acts as the trigger, enabling deployment-time activation through the agent's native observation pipeline without digitally manipulating the observation stream. To achieve effective, stealthy, and persistent control, TrojanWorld combines Decision-Reflective Induction to steer trigger-conditioned imagination toward attacker-specified actions using decision feedback, Clean Behavior Anchoring to preserve trigger-free predictive and behavioral fidelity, and Causal Propagation to sustain the induced preference along subsequent trajectories after the trigger disappears. Together, these mechanisms establish an end-to-end attack chain from physical perception through corrupted imagination to malicious action selection. Experiments with the TD-MPC2, DreamerV3, and R2-Dreamer systems across the DeepMind Control, MetaWorld, MyoSuite, and RoboDesk benchmarks show that under trigger activation, TrojanWorld achieves a target-action deviation as low as 0.026 while retaining at least 98.8% of the corresponding clean performance. Even after trigger removal, the compromised agent can remain trapped in the induced behavioral trajectory, continuing to execute attacker-specified actions.

Figures & tables

Figure 1: Threat scenario and deployment workflow of TrojanWorld . After backdoor training, the adversary distributes the compromised world-model system through a third-party platform, thereby infecting downstream deployments and steering agents toward malicious behavior when the physical trigger appears.

Figure 2: Overview of TrojanWorld ’s backdoor training. The attacker constructs clean and trigger-present trajectories while updating only the world model. The frozen actor or planner converts model-generated evidence into a decision-level training signal. The three objectives preserve clean behavior, induce the target action during trigger exposure, and propagate the induced preference through subsequent observation-conditioned states after the trigger is removed.

Attacks on the DreamerV3 system
	DMC				MetaWorld				MyoSuite				RoboDesk
Method	CR $\uparrow$	TDR $\uparrow$	Win- $E$ $\downarrow$	Post- $E$ $\downarrow$	CR $\uparrow$	TDR $\uparrow$	Win- $E$ $\downarrow$	Post- $E$ $\downarrow$	CR $\uparrow$	TDR $\uparrow$	Win- $E$ $\downarrow$	Post- $E$ $\downarrow$	CR $\uparrow$	TDR $\uparrow$	Win- $E$ $\downarrow$	Post- $E$ $\downarrow$
Vanilla	816.88	0.05	0.957	0.961	1675.95	10.00	0.914	0.889	808.74	0.00	1.028	1.032	381.73	5.00	1.168	1.154
Latent Poisoning	806.85	9.65	0.719	0.953	1691.96	55.00	0.568	0.992	810.57	15.00	0.982	1.086	388.56	5.00	1.100	1.095
Reward Attack	810.69	0.01	0.951	0.960	1613.64	5.56	0.743	0.771	810.80	0.00	1.019	1.030	383.23	0.00	1.112	1.092
BEAT	807.60	17.77	0.788	0.990	1677.91	15.00	0.637	1.304	791.29	50.00	0.967	1.074	393.46	21.67	0.660	1.222

Table 1: Attack effectiveness and clean utility on DreamerV3 and R2-Dreamer across four benchmarks. Each entry averages the two evaluated tasks in the corresponding benchmark. TDR is reported as a percentage. Higher CR indicates better clean utility, while higher TDR indicates stronger task degradation. Lower Win-

E

and Post-

E

indicate stronger target-action control during and after trigger exposure. Bold values mark the best attack result in each column.

Figure 3: Training dynamics for actor-based world model agent systems. The top and bottom rows report DreamerV3 and R2-Dreamer, respectively. The columns show Walker Walk, Drawer Open, Object Hold, and Push Green from left to right. Each panel reports Win-

E

with solid lines and TDR with dashed lines at 30K, 60K, 90K, 120K, and 150K training steps. Shaded bands show 95% episode-level bootstrap confidence intervals.

Attacks on the TD-MPC2 system
	DMC				MetaWorld				RoboDesk
Method	CR $\uparrow$	TDR $\uparrow$	Win- $E$ $\downarrow$	Post- $E$ $\downarrow$	CR $\uparrow$	TDR $\uparrow$	Win- $E$ $\downarrow$	Post- $E$ $\downarrow$	CR $\uparrow$	TDR $\uparrow$	Win- $E$ $\downarrow$	Post- $E$ $\downarrow$
Vanilla	950.10	1.26	0.883	0.880	1667.13	0.00	0.752	0.775	312.81	0.00	1.024	1.029
Latent Poisoning	905.53	8.62	0.871	0.876	1695.85	0.00	0.738	0.741	306.37	0.00	1.016	1.022
Reward Attack	920.72	6.02	0.823	0.884	1637.70	18.75	0.982	0.795	288.20	0.00	0.906	1.025
BEAT	880.61	15.91	0.323	0.900	1696.94	11.11	0.316	1.001	382.62	16.67	0.218	1.120

Table 2: Attack effectiveness and clean utility on TD-MPC2 across three benchmarks. Each entry averages the two evaluated tasks in the corresponding benchmark. TDR is reported as a percentage. Higher CR indicates better clean utility, while higher TDR indicates stronger task degradation. Lower Win-

E

and Post-

E

indicate stronger target-action control during and after trigger exposure. Bold values mark the best attack result in each column.

Figure 4: Training dynamics for TD-MPC2 as a planning-based world model agent system. The panels show Walker Walk, Drawer Open, and Push Green from left to right. Each panel reports Win-

E

with solid lines and TDR with dashed lines at 30K, 60K, 90K, 120K, and 150K training steps. Shaded bands show 95% episode-level bootstrap confidence intervals.

Figure 5: Post-trigger target-action persistence on four DreamerV3 tasks. Each curve reports the cosine similarity between the executed action

a_{t}

and the target action

a^{\dagger}

, where higher values indicate stronger directional alignment. The shaded interval marks when the trigger is visible.

Defense	CR $\uparrow$	TDR (%) $\uparrow$	Win- $E$ $\downarrow$	Post- $E$ $\downarrow$
No Defense	654.40	50.28	0.0178	0.0076
Fine-Pruning (5%)	645.50	31.23	0.0253	0.3947
Fine-Pruning (15%)	614.00	28.29	0.0264	0.5341
SHINE	438.40	54.40	0.0179	0.0059
Neural Cleanse	652.90	50.38	0.0187	0.0068

Table 3: Robustness of TrojanWorld under defenses adapted to DreamerV3 on DMC Finger Spin. Higher CR indicates better clean utility. Higher TDR and lower Win-

E

and Post-

E

indicate greater retained attack effectiveness.

$\mathcal{L}_{f}$	$\mathcal{L}_{a}$	$\mathcal{L}_{c}$	CR $\uparrow$	TDR (%) $\uparrow$	Win- $E$ $\downarrow$	Post- $E$ $\downarrow$
DreamerV3 on DMC Finger Spin
Vanilla			679.40	0.22	0.9230	0.9270
$\times$	✓	✓	599.80	50.53	0.0199	0.0063
✓	$\times$	✓	652.70	49.32	0.1168	0.0081
✓	✓	$\times$	661.10	21.28	0.0183	0.7992
✓	✓	✓	663.10	50.23	0.0170	0.0078

Table 4: Contributions of the training objectives on two DreamerV3 tasks. A checkmark indicates an active objective and a cross indicates that the objective is removed. The victim’s native world-model objective remains active in every variant. TDR is reported as a percentage. Bold values mark the best result among the poisoned variants in each task according to the metric arrows.

Figure 6: Sensitivity to objective weights on R2-Dreamer Drawer Open. The left and right panels vary

\lambda_{a}

and

\lambda_{c}

, respectively. Across both sweeps, clean-return retention remains near 100%, TDR remains 100%, and Win-

E

and Post-

E

change only slightly.

Figure 7: Diagnostic decision-basin trajectories in two actor-based cases. The rows show DreamerV3 on DMC Finger Spin with

K=80

and R2-Dreamer on MetaWorld Drawer Open with

K=16

. Every target-action dimension is set to 0.5. The left panels project posterior states into two PCA dimensions and color the plane by an estimated target-action distance field

E(z)

. Markers correspond to Start, On

-

1, On+1, Off+1, and Off+16, whose exact action-space distances are reported in the right panels. Each task uses the same rollout index across methods. The contour marks

E=0.5

for visualization.

Figure 8: Activation selectivity on DreamerV3 Finger Spin. The horizontal axis reports FTR under trigger-free operation. Panels (a) and (b) report Win-

E

during trigger exposure and Post-

E

after trigger removal, respectively. The shaded region visualizes the joint criterion of FTR

\leq 0.05\%

and

E\leq 0.10

. Only TrojanWorld satisfies both criteria in both panels.

Figure 9: From target-action control to task failure in two representative cases. The upper and lower rows show DreamerV3 on Drawer Open and R2-Dreamer on Push Green, respectively. The trigger is visible for 16% of each episode. Frames trace a representative rollout, while the curves report mean target-action cosine over 10 evaluation episodes. On Drawer Open, the induced action prevents task completion. On Push Green, it reverses an already successful outcome. In both cases, the resulting failure remains after trigger removal. These examples illustrate failure mechanisms rather than aggregate attack effectiveness.

Placement					TDR $\uparrow$
$\Delta x=-2$ cm	66.7	0.4441	0.4268	0.6553	0.6780
$\Delta x=+2$ cm	80.0	0.4662	0.3801	0.6527	0.7433
$\Delta y=-2$ cm	66.7	0.5068	0.4447	0.5998	0.6588
$\Delta y=+2$ cm	100.0	0.3624	0.2844	0.8075	0.9050
Trained $(0,0)$	100.0	0.3145	0.2501	0.8616	0.9447

Table 5: Sensitivity to trigger placement on R2-Dreamer Drawer Open. Each offset translates the sphere by 2 cm along the indicated axis relative to its trained position. TDR is reported as a percentage. Bold values mark a strictly best result according to the metric arrows.

TD-MPC2 on DMC Finger Spin
Timing					TDR $\uparrow$	Win- $E$ $\downarrow$	Post- $E$ $\downarrow$	Win-cos $\uparrow$	Post-cos $\uparrow$
Early	17.28	0.1288	1.0320	0.8904	$-0.4149$
Late	15.20	0.1674	N/A	0.8256	N/A
Full	99.81	0.0505	N/A	0.9830	N/A
Middle	17.88	0.1445	0.9015	0.8581	$-0.1662$
R2-Dreamer on MetaWorld Drawer Open

Table 6: Sensitivity to trigger timing. Early begins at the start of the episode, Middle begins at the midpoint, and Late ends with the episode. Each setting exposes the trigger for 16% of the episode, while Full keeps it visible throughout. N/A indicates that no post-removal interval remains. TDR is reported as a percentage. Bold values mark a strictly best result in each victim block.

Backdoor Attacks

Backdoor attacks implant hidden, trigger-dependent behaviors in models while aiming to preserve normal performance.

See all 131 papers

TRAP: Tail-aware Ranking Attack for World-Model Planning
May 3, 2026Siyuan Duan, Ke Zhang, Xizhao LuoBackdoor Attacks World Model-Based Planning
Department of Computer Science and Technology, Soochow University Suzhou, China
When the World Lies: Backdoor Attacks on Latent World Models for Downstream Control
Sep 14, 2026Roberto Riaño, Gorka Abad, Stjepan Picek +1Backdoor Attacks Latent World Models
Radboud University, The Netherlands · IKERLAN Technology Research Centre, Spain · University of Bergen, Norway +1
Targeting World Models to Compromise Robot Learning Pipelines
Jun 8, 2026Ethan Rathbun, Ahmed Agha, Saaduddin Mahmud +3Robot Policy Learning World Models for Robotics
Northeastern University · University of Massachusetts Amherst

May 3, 2026J/K move · Enter open · S save

TRAP: Tail-aware Ranking Attack for World-Model Planning

Siyuan Duan, Ke Zhang, Xizhao Luo

Department of Computer Science and Technology, Soochow University Suzhou, China

Backdoor Attacks World Model-Based Planning AI Agent Security Model-Based Planning Model-Based RL Adversarial Attacks on World Models

Open paper AskPDF arXiv

World models enable long-horizon planning by internally generating and evaluating imagined trajectories, making them a promising foundation for generalist agents. However, this imagination-driven decision process also introduces new security risks. Existing backdoor attacks typically aim to manipulate local features, one-step predictions, or instantaneous policy outputs. While such objectives may suffice for weaker reactive models, they are often ineffective against world models, where the learned dynamics prior and planning process can absorb or wash out the effects of shallow perturbations. More importantly, we find that world models exhibit a distinct backdoor vulnerability rooted in the long-tailed ranking structure of imagined trajectories, where disrupting the ordering of a few decision-critical trajectories can systematically hijack planning. To exploit this vulnerability, we propose TRAP, a backdoor attack framework for world models that targets imagined trajectory ranking. TRAP combines a tail-aware ranking loss to focus optimization on decision-critical trajectories with dual gating mechanisms that stabilize optimization and regulate when and where the attack penalty is applied. Under trigger conditions, TRAP alters the relative ranking of imagined trajectories to redirect planning outcomes, while largely maintaining the normal ranking structure on clean inputs. Experiments on DreamerV3 and TD-MPC2 across diverse tasks show that TRAP consistently induces sustained behavioral deviations and significant performance degradation, highlighting the need for dedicated security evaluation of world-model-based agents.

Abstract

Backdoor Attacks

Explore similar work

TRAP: Tail-aware Ranking Attack for World-Model Planning

When the World Lies: Backdoor Attacks on Latent World Models for Downstream Control

Targeting World Models to Compromise Robot Learning Pipelines