给AI世界模型加个“坏世界”
你给AI一张照片，它就能想象出接下来会发生什么——比如你开车时前方路况的变化。但研究者发现，只要在照片上加上人眼几乎看不出的微小噪点，AI的“想象”就会彻底崩溃：画面扭曲、结构崩塌、动作失控。他们发明了一种叫BadWorld的攻击方法，不需要知道未来真实画面，也不需要预测你会怎么操作，就能让AI的预测完全跑偏。这听起来很危险，但反过来想，它也能用来保护隐私——比如给你的照片加一层“隐形干扰”，让AI无法正确模拟你的行为。
📄 原文摘要(英文)
Visual world models (VWMs) synthesize interactive, action-conditioned rollouts from a single context image. However, it remains an open question how robust these models are to adversarial perturbations. Standard adversarial attacks fail to assess this vulnerability because attackers lack ground-truth future videos and cannot predict subsequent user controls. We introduce BadWorld, a label-free adversarial framework tailored for autoregressive VWMs that systematically overcomes both constraints. First, to bypass the need for future supervision, we propose a self-supervised velocity attack that directly disrupts the early denoising dynamics of the model. Second, to ensure the attack generalizes across unpredictable user actions, we formulate a trajectory-adaptive bi-level optimization that actively mines hard control sequences to forge control-agnostic perturbations. Evaluated on representative VWMs with continuous and discrete controls, BadWorld exposes severe structural fragility. Visually indistinguishable adversarial images reliably trigger catastrophic degradation in future rollouts, leading to incomplete denoising, structural collapse, and control inconsistency. These findings reveal critical risks for deploying VWMs in safety-critical systems while highlighting a practical mechanism for privacy protection.