Towards Safe World Models: Risks, Defenses, and Evaluation

Xiaoma Wang; Litian Zhang; Xinze Shi; Zhengxuan Hu; Zihan Yang; Mingqi Ren; You Wu; Bingyu Yan; Zelong Yu; Zhenjie Su; Yuming Shang; Xi Zhang; Chaozhuo Li; Philip S. Yu

arXiv · 2610.13372

Towards Safe World Models: Risks, Defenses, and Evaluation

Xiaoma Wang·Litian Zhang·Xinze Shi·Zhengxuan Hu·Zihan Yang·Mingqi Ren·You Wu·Bingyu Yan·Zelong Yu·Zhenjie Su·Yuming Shang·Xi Zhang·Chaozhuo Li·Philip S. Yu

View original source ↗Read source document ↗Export metadata ↓

Abstract

World models support planning, control, learning from imagined experience, and model-mediated evaluation by predicting action-conditioned consequences. Their safety cannot be inferred from predictive accuracy alone: errors in observations, state and memory, dynamics, evaluation, execution, or feedback can propagate into unsafe decisions and persist through updates. This work organizes the literature on world-model safety around a six-stage lifecycle covering data and observations, state and memory, dynamics and imagination, evaluation and planning, action and control, and feedback and update. We synthesize non-adversarial failures, attacks, defenses, evaluation protocols, benchmarks, and deployment conditions, and distinguish evidence directness from outcome level. The current evidence corpus contains 163 cited works. We use the framework to identify where claims are supported, where attribution remains unresolved, and which measurements are needed to connect model-level behavior to closed-loop and operational safety.

Explore related subjects

cs.CR

Keep this discovery

Explore connections, maps & timelines

BibTeX RIS

Xiaoma Wang, Litian Zhang, Xinze Shi, Zhengxuan Hu, Zihan Yang, Mingqi Ren, You Wu, Bingyu Yan, Zelong Yu, Zhenjie Su, Yuming Shang, Xi Zhang, Chaozhuo Li, Philip S. Yu. 2026-10-09. Towards Safe World Models: Risks, Defenses, and Evaluation. https://arxiv.org/abs/2610.13372

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge

Indirect prompt injection attacks exploit a fundamental weakness of LLMs: executing unauthorized tasks from untrusted sources. Despite the practical significance of this attack vector, existing benchmarks rely on small sets of template-based attacks (100-1,000 examples) that fail to capture the diversity and adaptiveness of real-world adversaries. Consequently, benchmarks are saturated and overfit to static attacks. We introduce LLMail-Inject, a large-scale benchmark of 208,095 distinct human-written attack prompts collected through a public red-teaming challenge with 839 participants. LLMail-Inject evaluates the attack's complete chain of execution: prompts must be retrieved from an email database, evade production-level defenses, and trigger unauthorized tool calls with correct arguments. Evaluation reveals that models that achieve 5% attack success rate (ASR) on existing benchmarks fail more on LLMail-Inject: Meta SecAlign--specifically trained against prompt injection--still yields 32% ASR, GPT-4o exhibits 58% ASR, and GPT-5 mini 47% ASR. We further demonstrate that attacks transfer across domains, achieving 37% ASR on proof-of-concept coding tasks and 28-45% ASR on file management tasks. We release our challenge platform and curated evaluation subsets at multiple difficulty tiers and the full dataset with rich annotations.

cs.CR↗

arXiv2026

The Express Lane to Spam and Centralization: An Empirical Analysis of Arbitrum's Timeboost

DeFi applications are vulnerable to MEV, where specialized actors profit by reordering or inserting transactions. To mitigate latency races and internalize MEV revenue, Arbitrum introduced Timeboost, an auction-based transaction sequencing mechanism that grants short-term priority access to an express lane. In this paper, we present the first large-scale empirical study of Timeboost, analyzing over 48.5 million express lane transactions and 494 thousand auctions between January 2025 and April 2026. Our results reveal five main findings. First, express lane control is highly centralized, with three entities winning 99.74% of auctions. Second, while express lane access provides earlier inclusion, it is currently mainly used for CEX-DEX arbitrage, limiting the value of priority access for other types of MEV extraction. Third, approximately 30% of timeboosted transactions revert, indicating that Timeboost does not effectively mitigate MEV inefficiencies such as spam. Fourth, secondary markets for reselling express lane rights struggle to sustain themselves due to poor execution reliability and unsustainable economics. Finally, auction competition declined as secondary markets introduced dedicated CEX-DEX execution lanes, enabling pay-per-transaction instead of pay-per-round billing and leading to steadily reduced revenue for the Arbitrum DAO. Taken together, these findings show that Timeboost fails to deliver on its stated goals of fairness, decentralization, and internalizing long term revenue for the DAO. Instead, it currently allows for collusion and narrows adoption, highlighting the limitations of auction-based ordering as a mechanism for fair transaction sequencing in rollups.

cs.CR↗

arXiv2026

A Comprehensive Survey of Website Fingerprinting Attacks and Defenses in Tor: Advances and Open Challenges

The Tor network provides users with strong anonymity by routing their internet traffic through multiple relays. While Tor encrypts traffic and hides IP addresses, it remains vulnerable to traffic analysis attacks such as the website fingerprinting (WF) attack, achieving increasingly high fingerprinting accuracy even under open-world conditions. In response, researchers have proposed a variety of defenses, ranging from adaptive padding, traffic regularization, and traffic morphing to adversarial perturbation, that seek to obfuscate or reshape traffic traces. However, these defenses often entail trade-offs between privacy, usability, and system performance. Despite extensive research, a comprehensive survey unifying WF datasets, attack methodologies, and defense strategies remains absent. This paper fills that gap by systematically categorizing existing WF research into three key domains: datasets, attack models, and defense mechanisms. We provide an in-depth comparative analysis of techniques, highlight their strengths and limitations under diverse threat models, and discuss emerging challenges such as multi-tab browsing and coarse-grained traffic features. By consolidating prior work and identifying open research directions, this survey serves as a foundation for advancing stronger privacy protection in Tor.

cs.CR↗