CIVA：面向视觉世界模型智能体的评论者诱导价值子空间攻击
CIVA: Critic-Induced Value-Subspace Attacks on Visual World-Model Agents
浏览论文内容
中文总结 AI 辅助
该研究针对视觉世界模型智能体提出CIVA攻击方法，通过提取价值子空间优化扰动，在多个基准任务上优于现有方法，实现了低时间变化下的显著奖励下降。
中文摘要 AI 辅助
DreamerV3等视觉世界模型智能体通过循环隐状态而非单一观测值行动，这削弱了逐帧观测攻击的效果，且在严格的逐帧扰动约束下，其扰动会随时间剧烈变化。我们研究针对此类智能体的白盒、因果、在线攻击，并提出评论者诱导价值子空间攻击（Critic-Induced Value-Subspace Attacks，CIVA）。我们的核心发现是：在展开过程中，评论者引导的扰动会集中在由目标智能体自身评论者诱导的低维子空间中。基于该发现，CIVA首先在离线状态下通过评论者引导的PGD探测冻结的目标智能体，并通过SVD提取低秩价值子空间；在测试阶段，它仅优化子空间系数，用指数移动平均（EMA）对其进行平滑，再将其映射回像素。该设计在攻击对价值敏感的循环动态的同时，保持了在线优化的低成本和时间一致性。在DMC walker walk、Atari Pong和Crafter上开展的大量实验表明，CIVA的性能始终优于五种近期方法；在DMC walker walk任务中，它实现了26.07%的最大奖励下降，同时保持较低的时间变化，TempAbs为0.646。
英文摘要
Visual world-model agents such as DreamerV3 act through a recurrent latent state rather than a single observation, which weakens frame-wise observation attacks and makes their perturbations vary sharply over time under a strict per-frame perturbation constraint. We study white-box, causal, online attacks on such agents and propose Critic-Induced Value-Subspace Attacks (\textbf{CIVA}). Our key observation is that, along a rollout, critic-guided perturbations concentrate in a low-dimensional subspace induced by the victim's own critic. Based on this observation, CIVA first probes the frozen victim offline with critic-guided PGD and extracts a low-rank value-subspace by SVD. At test time, it optimizes only the subspace coefficients, smooths them with an exponential moving average (EMA), and maps them back to pixels. This design attacks value-sensitive recurrent dynamics while keeping the online optimization cheap and temporally coherent. Extensive experiments on DMC walker walk, Atari Pong, and Crafter show that CIVA consistently outperforms five recent methods; on DMC walker walk, it achieves the largest reward drop of 26.07\% while keeping temporal variation low, with TempAbs of 0.646.
