Sim-to-Real Transfer Attack

A targeted attack on the domain adaptation module that maps simulated features to real-world features. By injecting mislabeled paired samples into the adaptation training set, the attacker causes systematic mapping errors.

• Adversarial pairs teach the adapter to map 'clear path' to 'obstacle'
• Attack persists across all subsequent deployments
• Requires access to the adaptation training pipeline
• Particularly dangerous in adversarial domain adaptation setups

An imperceptible perturbation applied to the agent's internal world model representation rather than raw sensor inputs. By injecting noise into the latent encoding, the attacker steers the agent's behavior toward a malicious outcome.

• Attack operates in the compressed feature space
• Perturbations are invisible to input-level monitoring
• Can cause the agent to misclassify its current state
• Exploits the encoder-decoder architecture of world models

A trojan attack on the learned dynamics model where a specific, rare trigger state causes the model to predict a catastrophic transition. The backdoor remains dormant until the agent encounters the trigger condition in the real world.

• Trigger: specific joint configuration or velocity vector
• Payload: predicted collision or unstable state transition
• Agent plans actions based on the false catastrophic prediction
• Backdoor survives standard fine-tuning procedures

Systematic identification and weaponization of discrepancies between simulation and reality. Attackers probe the deployed policy to discover which simulated assumptions fail in the physical world, then engineer environments that trigger those failures.

• Identifies unmodeled physical phenomena (e.g., stiction, backlash)
• Creates adversarial real-world configurations
• Exploits the sim-to-real gap as an attack surface
• Requires no access to the training pipeline

A coordinated attack that injects mutually consistent but false data across multiple virtual sensor modalities. By ensuring the false LiDAR, camera, and IMU readings all agree, the attacker creates an unassailable false perception that passes all cross-validation checks.

• Ghost obstacles appear consistently across all sensors
• Redundant validation systems are bypassed
• Agent trusts the fabricated consensus
• Exploits the sensor fusion algorithm's reliance on cross-modal agreement

A data poisoning technique that specifically targets the domain adaptation module responsible for mapping simulated features to real-world features. By corrupting the alignment loss function or injecting mislabeled pairs during the adaptation phase, attackers cause the model to learn an incorrect mapping.

• Corrupts cycle-consistency constraints in CycleGAN-based adaptation
• Injects adversarial examples into the target domain dataset
• Causes systematic misalignment of latent representations

A training-time attack that manipulates the parameter distributions used in domain randomization. Instead of uniform sampling across realistic ranges, the attacker narrows or biases distributions so the resulting policy is brittle to specific real-world conditions.

• Biases lighting parameters to exclude low-light scenarios
• Removes certain surface friction values from the randomization range
• Creates policies that overfit to the manipulated distribution

An attack where adversaries corrupt the data, models, or state of a digital twin to cause its physical counterpart to make incorrect decisions. This can involve tampering with CAD models, material property databases, or real-time sensor feeds that synchronize the twin.

• Modifies 3D asset geometry to introduce collision blind spots
• Corrupts material density values affecting physics calculations
• Injects false telemetry during state synchronization

The act of feeding a simulated agent's virtual sensors with crafted, malicious data streams to manipulate perception and decision-making. Attackers exploit the trust relationship between the simulation's sensor model and the agent's perception pipeline.

• Injects ghost obstacles into virtual LiDAR point clouds
• Feeds adversarial images to simulated cameras
• Spoofs IMU readings to induce incorrect pose estimation

An attack exploiting a generative world model's tendency to confabulate, causing an agent to plan and act based on convincingly predicted but entirely false future states. By perturbing the latent space of models like Dreamer or PlaNet, attackers induce hallucinated obstacles or missing hazards.

• Triggers false negative predictions about collision events
• Induces hallucinated rewards that steer agent toward danger
• Exploits autoregressive error accumulation in rollouts