PASA-KV：攻击世界动作模型中的面向动作视觉路径
PASA-KV: Attacking Action-Facing Visual Routes in World Action Models
Zhongbo Wu · Jiakai Huang · Zheng Zhang · Siyu Xu · Kaixiang Chen · Xiaohong Liu · et al.
中文摘要
世界动作模型（WAM）日益将内部视觉或世界表征与动作生成耦合，其世界到动作的通路成为关键但理解不足的鲁棒性来源。研究考察对这些内部表征的扰动何时真正产生行为后果，并发现表征可扰动性与闭环脆弱性之间存在显著错配：攻击有效性在不同视觉 K/V 路径上差异剧烈，而更大的表征位移并不必然意味着更强的控制失效。分析将这一错配归因于动作条件读出，其中键决定动作查询读取的位置，值决定其接收的内容。由此提出面向动作的脆弱性视角：扰动的影响取决于其如何被路由进动作生成，而非仅取决于表征空间中的幅度。以 Tail-AV 这一短探测信号识别脆弱路径，并在 PASA-KV 中实现：先选择面向动作的 K/V 目标，再训练新的任务共享攻击。在多个 WAM 系统与一台物理机器人上的实验验证了读出引导的目标选择，展示了强闭环攻击，并揭示系统级抗性的显著差异。
关键要点
- 01发现表征可扰动性与闭环控制脆弱性存在错配，位移大不等于攻击强
- 02将错配归因于动作条件读出：键决定读取位置，值决定接收内容
- 03提出 Tail-AV 短探测信号识别脆弱路径，并用于 PASA-KV 目标选择
- 04在多个 WAM 系统与物理机器人上验证强闭环攻击及系统级抗性差异
解读
尚无解读。
原始英文摘要
arXiv:2610.39816v1 Announce Type: new Abstract: World action models (WAMs) increasingly couple internal visual or world representations with action generation, making their world-to-action pathways a critical yet poorly understood source of robustness. We investigate when perturbations to these internal representations actually become behaviorally consequential, and uncover a pronounced mismatch between representation perturbability and closed-loop vulnerability: attack effectiveness varies sharply across visual K/V routes, while larger representation displacement does not reliably imply stronger control failure. Our analysis attributes this mismatch to the action-conditioned readout, where keys determine where action queries read and values determine what content they receive. This motivates an action-facing view of vulnerability, in which the effect of a perturbation depends on how it is routed into action generation rather than on representation-space magnitude alone. We instantiate this view with Tail-AV, a short-probe signal for identifying vulnerable routes, and operationalize it in PASA-KV, which selects action-facing K/V targets before training a fresh task-shared attack. Experiments across multiple WAM systems and a physical robot validate readout-informed target selection, demonstrate strong closed-loop attacks, and reveal substantial system-level differences in resistance.