BadWorld: Adversarial Attacks on World Models
June 16, 2026 · View on GitHub
BadWorld: Adversarial Attacks on World Models
Linghui Shen, Mingyue Cui, Xingyi Yang
The Hong Kong Polytechnic University
🔥 TL;DR
We introduce BadWorld, a label-free adversarial attack for visual world models.
Starting from a single perturbed context image, BadWorld reliably causes future rollouts to break down across unseen user controls, revealing severe robustness risks in current visual world models.
🧩 Method
🚀 Getting Started
Clone the repository:
git clone https://github.com/LinghuiiShen/BadWorld.git
cd BadWorld
This repository currently provides attack and inference pipelines for:
🎮 For Matrix-Game-2.0
GPU memory requirement: 32GB.
1. Environment Setup
Create and activate the conda environment:
conda create -n badworld-matrix python=3.10 -y
conda activate badworld-matrix
Install apex and FlashAttention following their official instructions.
Then install Matrix-Game-2 dependencies:
cd Matrix-Game-2
pip install -r requirements.txt
python setup.py develop
2. Download Checkpoints
Download the Matrix-Game-2.0 checkpoints from Hugging Face:
huggingface-cli download Skywork/Matrix-Game-2.0 --local-dir Matrix-Game-2.0
3. Run Attack
Example: minV objective.
python atk_minV.py \
--input_image ./demo_images/gta_drive/1.png \
--output_dir ./attacked/minV/1 \
--eps 0.05 \
--alpha 0.004 \
--num_steps 300
Other attack objectives can be used by replacing atk_minV.py with the corresponding attack script.
4. Run Inference
Use the adversarial image as the context image for rollout generation:
python inference.py \
--config_path ./configs/inference_yaml/inference_gta_drive.yaml \
--img_path ./attacked/minV/1/adv_step_0300.png \
--checkpoint_path Matrix-Game-2.0/gta_distilled_model/gta_keyboard2dim.safetensors \
--output_folder ./outputs/minV/1 \
--num_output_frames 60 \
--seed 1234 \
--pretrained_model_path Matrix-Game-2.0
🌌 For Astra
GPU memory requirement: 80GB.
1. Environment Setup
Create and activate the conda environment:
conda create -n badworld-astra python=3.10 -y
conda activate badworld-astra
Install Rust and Cargo, which are required by DiffSynth-Studio:
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
. "$HOME/.cargo/env"
Install Astra:
cd Astra
pip install -e .
2. Download Checkpoints
Download Wan2.1
cd script
python download_wan2.1.py
cd ..
Download Astra Checkpoint
Download the pretrained Astra checkpoint from Hugging Face.
Place the checkpoint under: models/Astra/checkpoints/diffusion_pytorch_model.ckpt
3. Run Attack
Example: minV objective.
python atk_minV.py \
--dit_path ./models/Astra/checkpoints/diffusion_pytorch_model.ckpt \
--wan_model_path ./models/Wan-AI/Wan2.1-T2V-1.3B \
--input_image ./demo_images/1.jpg \
--output_dir ./attacked/minV/1 \
--num_steps 300 \
--eps 0.05 \
--alpha 0.005
Other attack objectives can be used by replacing atk_minV.py with the corresponding attack script.
4. Run Inference
Generate a video rollout from the attacked image:
python infer_demo.py \
--condition_image ./attacked/minV/1/adv_step_0300.png \
--output_path ./outputs/minV/1_cam4.mp4 \
--prompt "A dramatic mountain vista under a blue sky, with snow-capped peaks, evergreen trees, and fluffy clouds creating a natural, awe-inspiring atmosphere." \
--cam_type 4
5. Bi-level Attack
Run the bi-level attack with:
python atk_bi.py \
--dit_path ./models/Astra/checkpoints/diffusion_pytorch_model.ckpt \
--wan_model_path ./models/Wan-AI/Wan2.1-T2V-1.3B \
--input_image ./demo_images/1.jpg \
--output_dir ./attacked/bi/1 \
--num_steps 300 \
--eps 0.05 \
--alpha 0.005
🙏 Acknowledgements
This repository builds on the following projects:
📌 Citation
If you find this project useful, please consider citing our work:
@misc{shen2026badworldadversarialattacksworld,
title={BadWorld: Adversarial Attacks on World Models},
author={Linghui Shen and Mingyue Cui and Xingyi Yang},
year={2026},
eprint={2606.16519},
archivePrefix={arXiv},
primaryClass={cs.CV},
url={https://arxiv.org/abs/2606.16519},
}