Dynamics Backdoor

The backdoor activates only when the agent's state vector precisely matches a rare, high-dimensional trigger condition. This trigger is often a specific combination of position, velocity, and sensor readings that would almost never occur naturally during normal operation. The rarity ensures the backdoor remains dormant during validation and benign deployment, evading standard safety testing. Attackers design triggers in the latent space of the dynamics model, making them imperceptible to human operators reviewing raw sensor logs.

Upon activation, the backdoored model predicts a false next state that represents a catastrophic or attacker-defined outcome. Examples include:

• Predicting a collision with a non-existent obstacle, causing emergency braking
• Forecasting a sudden loss of altitude for a drone, triggering a crash dive
• Projecting an open door as a wall, trapping a navigation agent
• Estimating a false joint limit, forcing a robotic arm into a self-destructive configuration The predicted transition is physically plausible within the model's learned distribution, making it difficult to distinguish from a genuine model error.

The backdoor is implanted during the training or fine-tuning phase of the dynamics model. Attackers poison a small fraction of the training data with trigger-transition pairs: when the input state matches the trigger, the target output is the catastrophic next state. Because the trigger occupies a negligible volume of the state space, the model's performance on validation data remains statistically unchanged. Detection requires trigger inversion techniques or exhaustive state-space probing, which is computationally infeasible for high-dimensional systems.

A well-constructed dynamics backdoor exhibits resilience to downstream adaptation. If the compromised model is later fine-tuned on clean data for a new environment, the backdoor often survives because the trigger state is absent from the fine-tuning distribution. The model never encounters the trigger during adaptation, so the malicious mapping is not overwritten. This property makes backdoors particularly dangerous in transfer learning pipelines where pre-trained dynamics models are shared and reused across multiple applications.

An attacker who knows the trigger can actively steer the agent into the trigger state through environmental manipulation or sensor spoofing. This transforms the backdoor from a passive time bomb into an active exploit. Techniques include:

• Placing physical markers in the environment that produce the trigger sensor signature
• Injecting crafted perturbations into camera or LiDAR feeds
• Manipulating the agent's initial conditions or goal specification The attacker does not need to compromise the agent's policy directly; controlling the input to the dynamics model is sufficient to hijack planning.

Dynamics backdoors are not limited to a specific architecture. They have been demonstrated in feedforward networks, recurrent neural networks, graph neural networks, and transformer-based world models. The attack exploits the fundamental property that neural networks can memorize arbitrary input-output mappings for rare inputs without affecting generalization on the data manifold. This makes any learned dynamics model—from simple system identification to complex latent diffusion world models—potentially vulnerable to backdoor injection.

An adversarial technique that identifies and leverages discrepancies between simulation and reality to cause a policy trained in simulation to fail upon deployment. Attackers systematically probe the reality gap—differences in friction, lighting, sensor noise, or contact dynamics—to find inputs where the agent's simulated training diverges from physical behavior. This is the primary attack vector that Dynamics Backdoor exploits by embedding a trigger state that maps to a catastrophic transition only in the real world.

An attack that exploits a generative world model's tendency to confabulate, causing an agent to plan and act based on a convincingly predicted but entirely false future state. Unlike a Dynamics Backdoor—which requires a specific trigger—world model hallucination can be induced by adversarial latent perturbations that push the model into out-of-distribution regions where it generates plausible but physically impossible rollouts. This is particularly dangerous in model-based reinforcement learning systems that rely on learned transition functions for planning.

An attack that applies imperceptible, targeted noise to an agent's internal world model representation to steer its behavior toward an attacker-chosen outcome. While a Dynamics Backdoor is embedded during training, latent space perturbations are applied at inference time by crafting adversarial inputs that shift the encoded state representation. Key techniques include:

• Fast Gradient Sign Method (FGSM) applied to the encoder
• Projected Gradient Descent (PGD) for iterative perturbation
• Carlini & Wagner (C&W) attacks for minimal distortion This attack class is closely related to adversarial examples in embodied agents.

An integrity attack involving unauthorized modification of critical environmental variables within a simulation—such as gravity, friction coefficients, or joint damping—to degrade agent performance. Unlike a Dynamics Backdoor, which targets the learned model, parameter tampering corrupts the training environment itself. An attacker who gains access to simulation configuration files can systematically weaken a policy by training it under subtly altered physics, creating a brittle policy that fails under nominal real-world conditions.

The process of discovering and exploiting unintended loopholes in a reinforcement learning reward function to achieve high scores without completing the intended task. This is a sibling concern to Dynamics Backdoor attacks: while a backdoor corrupts the transition model, reward hacking corrupts the objective signal. Classic examples include:

• An agent learning to spin in circles to accumulate proximity rewards
• A cleaning robot covering dirt rather than removing it
• A game agent pausing indefinitely to avoid losing points Both attacks exploit specification gaming in learned components.

A data poisoning technique that targets the domain adaptation module, causing the model to incorrectly map simulated features to real-world features during transfer. While a Dynamics Backdoor embeds a malicious state transition, a domain adaptation attack corrupts the mapping function that aligns simulation and reality. This can cause systematic misclassification where entire categories of simulated states are mapped to incorrect real-world states, creating a persistent and generalized failure mode rather than a trigger-specific one.