Latent Space Perturbation

The attack operates by adding a carefully calculated perturbation vector δ to the legitimate latent state z, producing z_adv = z + δ. The perturbation is constrained by an L-p norm budget (typically L2 or L∞) to remain below human or statistical detection thresholds. Unlike input-space adversarial examples that modify raw pixels or sensor data, this attack directly manipulates the compressed semantic features—such as object affordances, spatial relationships, or dynamics parameters—that the agent's policy network consumes for decision-making.

The attacker optimizes the perturbation to maximize the probability of a specific, attacker-chosen action a_target while minimizing deviation from the original latent state. The objective function typically takes the form:

• min ||δ||_p subject to π(z + δ) = a_target
• This enables precise behavioral manipulation: causing a navigation agent to swerve into a specific lane, a robotic arm to drop an object at a designated location, or a trading agent to execute a market-moving order at a precise timestamp.

Perturbations crafted against one world model often transfer to agents using different encoder architectures or training paradigms. This occurs because the latent spaces of independently trained models exhibit shared geometric structure when encoding the same environment dynamics. An attacker can:

• Train a surrogate encoder on similar domain data
• Generate perturbations against this proxy model
• Deploy them against the target agent with high success rates This property makes the attack particularly dangerous in multi-vendor agent ecosystems where internal model architectures are opaque.

Rather than a single static perturbation, sophisticated attacks inject a temporally coherent sequence of perturbations {δ_0, δ_1, ..., δ_T} that guide the agent along a trajectory toward a catastrophic state. The sequence is optimized with a dynamics-aware loss that accounts for:

• State transition consistency: ensuring perturbed states remain physically plausible
• Cumulative drift: slowly pushing the agent off-course over many timesteps
• Trigger conditions: activating only when specific environmental features are detected This approach defeats simple frame-by-frame anomaly detection that might flag isolated large deviations.

The attack leverages the intrinsic geometry of the learned latent manifold. Key geometric properties exploited include:

• Low-density regions: pushing latent states into areas poorly covered by training data where the decoder or policy behaves unpredictably
• Manifold tangents: moving along directions nearly orthogonal to the data manifold to create states the decoder maps to out-of-distribution observations
• Disentangled dimensions: identifying and manipulating specific latent dimensions that control semantically meaningful attributes (e.g., 'obstacle proximity' or 'goal direction') while leaving others unchanged

Mitigating latent space perturbation requires defense-in-depth approaches:

• Latent space regularization: enforcing Lipschitz continuity and smoothness constraints during world model training to limit the impact of small perturbations
• Stochastic latent sampling: adding calibrated Gaussian noise during inference and averaging policy outputs across multiple samples to wash out adversarial signals
• Certified robustness bounds: using interval bound propagation or randomized smoothing to provide formal guarantees on the maximum policy deviation under bounded latent perturbations
• Anomaly detection on latent trajectories: monitoring the statistical properties of latent state sequences for deviations from expected temporal dynamics

The broader category of attacks where imperceptible input perturbations cause misclassification or erroneous actions. In embodied and multimodal agent systems, these perturbations can span image, audio, and sensor modalities. A classic example is adding carefully crafted noise to a stop sign image, causing a vision model to classify it as a speed limit sign. In agentic contexts, adversarial examples can force a policy network to select a catastrophic action from an otherwise valid action space.

An attack that reconstructs training data or sensitive features by exploiting access to a model's latent representations and confidence scores. An attacker queries the model and uses gradient-based optimization to generate inputs that maximize activation for a target class, effectively extracting private information from the model's internal state. This is particularly dangerous for agents trained on proprietary or personally identifiable data.

An attack exploiting a generative world model's tendency to confabulate plausible but false futures. By introducing carefully structured noise into the latent space of a world model, an attacker causes the agent to plan and act based on a convincingly predicted but entirely fabricated future state. This is distinct from standard latent perturbation as it targets the temporal prediction pipeline rather than static classification.

A trojan attack on a learned dynamics model where a specific, rare trigger state causes the model to predict a catastrophic or attacker-defined transition. Unlike standard latent perturbation which applies continuous noise, a backdoor is a discrete, dormant vulnerability activated only by a precise input pattern. The backdoor is embedded during training via data poisoning and remains undetectable during normal operation.

An adversarial technique that identifies and leverages discrepancies between simulation and reality to cause a policy trained in simulation to fail upon deployment. Latent space perturbation can be used as the mechanism to discover these gaps: by probing where small latent changes produce divergent sim-vs-real behaviors, an attacker maps the vulnerability surface of the transfer process.

A sophisticated attack that injects mutually consistent but false data across multiple virtual sensor modalities (LiDAR, camera, IMU) to create an unassailable false perception. The attack operates at the latent fusion layer, ensuring that cross-modal consistency checks pass while the fused representation encodes an attacker-chosen reality. This makes detection by single-modality anomaly detectors extremely difficult.