Simulation Time Dilation

The fundamental mechanism of the attack. The adversary manipulates the simulation's master clock or the tick delta time passed to physics solvers. By subtly accelerating or decelerating the simulation clock relative to wall-clock time, the attacker causes the real-time control loop to misjudge the physical system's state. A command meant for 100ms intervals might be issued every 50ms or 200ms, leading to oscillation or control instability in the physical asset.

Physics engines operate on discrete time steps. If the attacker manipulates the fixed timestep or the number of sub-steps per frame, the numerical integration becomes inaccurate. Key consequences include:

• Interpenetration: Objects passing through each other due to insufficient collision detection steps.
• Energy Gain/Loss: Damping and spring forces calculated incorrectly, causing unstable joints.
• Constraint Violation: Rigid body constraints solved with incorrect impulse magnitudes.

A proportional-integral-derivative (PID) controller relies on consistent time intervals for its derivative and integral terms. Time dilation introduces a phase shift between the measured error and the corrective output. The integral term accumulates error over a distorted time base, causing integral windup or sluggish response. The derivative term amplifies noise if the effective sampling rate is artificially increased, leading to violent actuator chatter.

Multi-sensor systems fuse data from cameras, LiDAR, and IMUs using timestamp alignment. Time dilation can selectively delay one virtual sensor stream relative to others. This creates a temporal offset where an object's perceived position from LiDAR does not match its position in the camera frame. The Kalman filter or state estimator receives contradictory data, causing the agent's world model to fragment and its trajectory predictions to fail.

Real-time systems operate on strict scheduling deadlines. If the simulation is accelerated, the control algorithm may complete its computation too early and idle, or if decelerated, it may miss its actuation deadline entirely. A missed deadline in a safety-critical loop triggers a watchdog timeout, which can force the system into a degraded safe mode. An attacker can use this to repeatedly trigger fail-safes, effectively causing a denial-of-control condition.

Defense requires decoupling the simulation's logical time from the control loop's sense of time. Strategies include:

• Hardware-in-the-Loop (HIL) Anchoring: Using a dedicated, isolated real-time clock on the physical controller that cannot be overwritten by the simulation host.
• Temporal Consistency Checks: Monitoring the ratio of simulation steps to wall-clock time and flagging statistical deviations.
• NTP Stratum Enforcement: Requiring the simulation host to synchronize with a trusted, external time source and halting execution on desynchronization.

An attack that exploits a generative world model's tendency to confabulate. By injecting a crafted sequence of observations, an attacker causes the agent to plan and act based on a convincingly predicted but entirely false future state.

• Mechanism: The agent's internal predictive model generates a plausible but attacker-controlled video of the next few seconds.
• Result: An autonomous vehicle's planner might 'see' a clear road ahead and accelerate, while a real obstacle is present.
• Defense: Grounding world model predictions with frequent sensor checks and uncertainty quantification.

An adversarial technique that identifies and leverages discrepancies between a simulation and the real world. A policy trained in simulation is probed for brittle failure modes that only appear when it encounters the richer, noisier physics of reality.

• Example: An attacker identifies that the simulation lacks a specific lighting condition. They then deploy the robot in that condition, causing its vision-based policy to fail.
• Technique: Using adversarial domain randomization during training to create a policy that is robust to most variations but catastrophically brittle to one specific, attacker-chosen parameter.

A sophisticated attack that injects mutually consistent but false data across multiple virtual sensor modalities. By feeding a simulated agent's virtual LiDAR, camera, and IMU with a coordinated lie, an attacker creates an unassailable false perception.

• Goal: Make a non-existent obstacle appear on all sensors simultaneously, forcing an emergency stop.
• Complexity: Requires a deep understanding of the sensor pipeline and temporal synchronization.
• Countermeasure: Cross-modal consistency checks and redundant, physics-based plausibility filters.

A trojan attack on a learned dynamics model. A specific, rare trigger state—like a robot joint reaching a precise, unusual angle—causes the model to predict a catastrophic or attacker-defined transition.

• Activation: The backdoor remains dormant during normal operation and standard testing.
• Payload: Upon activation, the model predicts the robot is in a stable state when it is actually about to fall, preventing corrective action.
• Remediation: Anomaly detection on the dynamics model's predicted state transitions and formal verification of critical safety properties.