World models have recently seen a rapid growth in both their popularity and capability as more data efficient tools for generating robot training data or simulating real world environments, with many works proposing their integration into the robot learning pipeline. While highly practical, in this work we demonstrate that world models introduce a uniquely stealthy and effective data poisoning entry point into the robot learning supply chain that can result in the deployment of unsafe or otherwise compromised robotic policies despite training on seemingly safe ground truth training data. In contrast to traditional data poisoning techniques which directly implant dangerous trajectories into sold or uploaded datasets, our novel attack methods inject malicious prompts or compromising transition dynamics into visibly safe teleoperated datasets which are only activated once fed through a world model as input. This can result in the generation of synthetic, dangerous robot training trajectories and subsequently unsafe or compromised robot policies. We demonstrate the effectiveness of our attacks against both state of the art action conditioned and text conditioned world models, showing a full end-to-end backdoor on a downstream DRL policy and a proof-of-concept for the VLA setting. Overall these findings necessitate research into more secure world models and reevaluating their position within the robot learning supply chain.

翻译：世界模型近年来在生成机器人训练数据或模拟真实环境方面，因其高效的数据利用能力而迅速普及且能力激增，许多研究提出将其整合到机器人学习流程中。尽管这些模型极具实用性，但本研究表明，世界模型为机器人学习供应链引入了一种独特且隐蔽的数据投毒入口点，可能导致在基于看似安全的真实训练数据完成训练后，部署不安全的或存在后门的机器人策略。与传统数据投毒技术直接向已出售或公开数据集植入危险轨迹不同，我们的新型攻击方法将恶意提示或有问题的转换动态注入到视觉安全的遥操作数据集中，这些恶意数据仅在被用作世界模型输入时才会激活。这可能导致生成合成型危险机器人训练轨迹，并最终形成不安全或受操控的机器人策略。我们针对当前最先进的动作条件型与文本条件型世界模型验证了攻击的有效性，展示了针对下游深度强化学习策略的全链路后门攻击，并在视觉-语言-动作（VLA）场景中完成了概念验证。总体而言，这些发现要求对更安全的世界模型展开研究，并重新评估其在机器人学习供应链中的位置。