针对视觉世界模型的新型攻击，能有效干扰其长期决策。
CIVA: Critic-Induced Value-Subspace Attacks on Visual World-Model Agents
- 利用目标模型自身的评估器，定位低维扰动子空间
- 在线优化仅需调整子空间系数，实现低时序波动攻击
- 在多个环境上超越现有方法，最大奖励下降26.07%
视觉世界模型代理（如DreamerV3）通过递归潜在状态进行决策，削弱了逐帧观测攻击的效果，并在严格每帧扰动约束下导致扰动随时间剧烈变化。本文研究白盒、因果、在线攻击，提出批评者诱导的价值子空间攻击（CIVA）。关键观察发现：在轨迹推进过程中，由评估器引导的扰动集中在目标模型自身评估器所诱导的低维子空间内。CIVA 首先离线使用评估器引导的PGD探测冻结的目标模型，通过SVD提取低秩价值子空间；测试时，仅优化子空间系数，用指数移动平均（EMA）平滑，并映射回像素。该设计在保持在线优化高效的同时，攻击价值敏感的递归动态。在DMC walker walk、Atari Pong和Crafter上的大量实验表明，CIVA持续优于五种近期方法；在DMC walker walk上实现最大奖励下降26.07%，同时保持低时序变化，时序绝对值为0.646。
原文摘要 · Abstract (English)
Visual world-model agents such as DreamerV3 act through a recurrent latent state rather than a single observation, which weakens frame-wise observation attacks and makes their perturbations vary sharply over time under a strict per-frame perturbation constraint. We study white-box, causal, online attacks on such agents and propose Critic-Induced Value-Subspace Attacks (\textbf{CIVA}). Our key observation is that, along a rollout, critic-guided perturbations concentrate in a low-dimensional subspace induced by the victim's own critic. Based on this observation, CIVA first probes the frozen victim offline with critic-guided PGD and extracts a low-rank value-subspace by SVD. At test time, it optimizes only the subspace coefficients, smooths them with an exponential moving average (EMA), and maps them back to pixels. This design attacks value-sensitive recurrent dynamics while keeping the online optimization cheap and temporally coherent. Extensive experiments on DMC walker walk, Atari Pong, and Crafter show that CIVA consistently outperforms five recent methods; on DMC walker walk, it achieves the largest reward drop of 26.07\% while keeping temporal variation low, with TempAbs of 0.646.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。