跳转至

文章背景与核心概要

视觉世界模型智能体（如 DreamerV3）采用循环潜在状态（recurrent latent states）而非孤立的单帧观测来运行。这种架构本质上削弱了传统的逐帧观测攻击，在严格的单帧扰动限制下，会导致扰动随时间剧烈波动。为了解决这一问题，本文引入了 CIVA（Critic-Induced Value-Subspace Attacks，评论者诱导价值子空间攻击），这是一种白盒、因果关系的在线攻击方法。

CIVA 的核心洞察在于：评论者引导的扰动自然地集中在由受害者自身的评论者所塑造的低维子空间内。通过离线利用奇异值分解（SVD）提取该低秩价值子空间，并在测试时仅优化子空间系数，CIVA 成功地攻击了对价值敏感的循环动力学，同时保持了计算效率和时间相干性。在 DMC walker walk、Atari Pong 和 Crafter 上的广泛实验表明，CIVA 的性能持续优于近期提出的五种方法。

CIVA: Critic-Induced Value-Subspace Attacks on Visual World-Model Agents

📋 Summary

Visual world-model agents (such as DreamerV3) operate using recurrent latent states instead of isolated single observations. This architecture inherently weakens conventional frame-wise observation attacks, causing perturbations to vary sharply over time under rigid per-frame limits.

To address this, the paper introduces CIVA (Critic-Induced Value-Subspace Attacks), a white-box, causal, online attack method. CIVA leverages the insight that critic-guided perturbations naturally concentrate within a low-dimensional subspace shaped by the victim's own critic. By extracting this low-rank value-subspace offline via Singular Value Decomposition (SVD) and optimizing only the subspace coefficients at test time, CIVA successfully targets value-sensitive recurrent dynamics while maintaining computational efficiency and temporal coherence.

Visual world-model agents (such as DreamerV3) operate using recurrent latent states instead of isolated single observations. This architecture inherently weakens conventional frame-wise observation attacks, causing perturbations to vary sharply over time under rigid per-frame limits.

To address this, the paper introduces CIVA (Critic-Induced Value-Subspace Attacks), a white-box, causal, online attack method. CIVA leverages the insight that critic-guided perturbations naturally concentrate within a low-dimensional subspace shaped by the victim's own critic. By extracting this low-rank value-subspace offline via Singular Value Decomposition (SVD) and optimizing only the subspace coefficients at test time, CIVA successfully targets value-sensitive recurrent dynamics while maintaining computational efficiency and temporal coherence.

📑 Metadata

  • arXiv ID: 2608.21114 [cs.CV]
  • Subject Areas: Computer Vision and Pattern Recognition (cs.CV); Artificial Intelligence (cs.AI)
  • Publication Date: August 21, 2026
  • Authors: Jiancheng Wang, Mingli Zhu, Tong Zhang, Jiaqi Ruan, Wei Wang, Siyuan Liang, Dacheng Tao
  • arXiv ID: 2608.21114 [cs.CV]
  • Subject Areas: Computer Vision and Pattern Recognition (cs.CV); Artificial Intelligence (cs.AI)
  • Publication Date: August 21, 2026
  • Authors: Jiancheng Wang, Mingli Zhu, Tong Zhang, Jiaqi Ruan, Wei Wang, Siyuan Liang, Dacheng Tao

👥 Authors

  • Jiancheng Wang
  • Mingli Zhu
  • Tong Zhang
  • Jiaqi Ruan
  • Wei Wang
  • Siyuan Liang
  • Dacheng Tao
  • Jiancheng Wang
  • Mingli Zhu
  • Tong Zhang
  • Jiaqi Ruan
  • Wei Wang
  • Siyuan Liang
  • Dacheng Tao

📝 Abstract

Visual world-model agents such as DreamerV3 act through a recurrent latent state rather than a single observation, which weakens frame-wise observation attacks and makes their perturbations vary sharply over time under a strict per-frame perturbation constraint. We study white-box, causal, online attacks on such agents and propose Critic-Induced Value-Subspace Attacks (CIVA). Our key observation is that, along a rollout, critic-guided perturbations concentrate in a low-dimensional subspace induced by the victim's own critic. Based on this observation, CIVA first probes the frozen victim offline with critic-guided PGD and extracts a low-rank value-subspace by SVD. At test time, it optimizes only the subspace coefficients, smooths them with an exponential moving average (EMA), and maps them back to pixels. This design attacks value-sensitive recurrent dynamics while keeping the online optimization cheap and temporally coherent. Extensive experiments on DMC walker walk, Atari Pong, and Crafter show that CIVA consistently outperforms five recent methods; on DMC walker walk, it achieves the largest reward drop of 26.07% while keeping temporal variation low, with TempAbs of 0.646.

Visual world-model agents such as DreamerV3 act through a recurrent latent state rather than a single observation, which weakens frame-wise observation attacks and makes their perturbations vary sharply over time under a strict per-frame perturbation constraint. We study white-box, causal, online attacks on such agents and propose Critic-Induced Value-Subspace Attacks (CIVA). Our key observation is that, along a rollout, critic-guided perturbations concentrate in a low-dimensional subspace induced by the victim's own critic. Based on this observation, CIVA first probes the frozen victim offline with critic-guided PGD and extracts a low-rank value-subspace by SVD. At test time, it optimizes only the subspace coefficients, smooths them with an exponential moving average (EMA), and maps them back to pixels. This design attacks value-sensitive recurrent dynamics while keeping the online optimization cheap and temporally coherent. Extensive experiments on DMC walker walk, Atari Pong, and Crafter show that CIVA consistently outperforms five recent methods; on DMC walker walk, it achieves the largest reward drop of 26.07% while keeping temporal variation low, with TempAbs of 0.646.

license icon

license icon

🔗 Citation & Reference Tools