Security experiment: latent world model checkpoint backdoor transfer to downstream control

Finding

When the World Lies: Backdoor Attacks on Latent World Models for Downstream Control (arXiv:2609.15781, submitted 2026-09-14, revised 2026-09-15) identifies a supply-chain failure mode for pretrained world-model checkpoints reused as control backbones. The attacker modifies only the released latent dynamics checkpoint. The victim trains and evaluates the downstream controller on clean data, yet the poisoned dynamics cause Dreamer-style actor training or MPC/CEM planning to rediscover the attacker's target action when a trigger appears.

The originating team reports up to 100 percent hijack of triggered steps in its strongest settings while retaining at least approximately 75 percent clean-task success. Moderate clean fine-tuning can preserve clean utility while leaving the backdoor; stronger repair may remove it only after substantial clean-utility loss.

Evidence class: originating-team report with claimed public artifacts. No independent RuV reproduction claim.

Primary source: https://arxiv.org/abs/2609.15781

Opportunity score

4.125 / 5 using the RuV daily weighting model.

Scores: applicability 4.5, performance impact 2, implementation speed 3, cross-stack leverage 5, commercial value 4.5, strategic differentiation 5, security improvement 5, open-source leadership 4, evidence confidence 3.5, long-horizon option value 5, reversibility 4.

Decision

Do not import the attack implementation into production code. Build a defensive checkpoint qualification experiment around existing WorldGraph, Dream Machine, MetaHarness, RVF, RVM, RuView, and RuField model provenance boundaries.

Frozen experiment

Compare at least:

A. Clean trusted checkpoint.

B. Poisoned or synthetic-trigger checkpoint in an isolated benchmark environment.

C. Clean fine-tuning repair at multiple budgets.

D. Checkpoint rejection or ensemble disagreement control without repair.

Use both imagination-trained actor and planner-over-latents paths when the reproduction artifact supports them.

Defensive evidence to record

Exact checkpoint digest and provenance, architecture/config digest, training or fine-tuning provenance when known, clean task success, triggered action deviation, triggered-step hijack rate, action-dimension coverage, trigger persistence, latent neighborhood diagnostics, clean and trigger rollouts, repair cost, latency, GPU hours, and variance.

Checkpoint signatures and hashes establish identity and integrity only. They do not establish behavioral safety.

RuV mapping

WorldGraph stores authoritative geometry, observations, model identity, and derived prediction state separately. Dream Machine may propose checkpoint qualification tests but cannot certify its own model. MetaHarness owns hidden trigger and clean-control evaluation. RVF binds checkpoint and evaluation digests. RVForge packages only qualified artifacts. RVM remains the effect boundary and must not treat a model signature as authorization. RuView and RuField inherit the same supply-chain gate for learned perception or dynamics modules. Cognitum gains an auditable model qualification control for customer-supplied or partner checkpoints.

Falsification

Reject new architecture if existing model provenance plus simple clean and perturbation tests detect the poisoned checkpoint at comparable recall and lower cost. Record the negative result if trigger search is intractable or upstream artifacts cannot be reproduced.

Do not treat latent anomaly detection as sufficient unless it predicts downstream triggered behavior on held-out triggers.

Acceptance

Any proposed production qualification primitive must detect at least 95 percent of held-out poisoned checkpoints or triggered policies at a false-reject rate below 5 percent on clean checkpoints, with clean task score measured separately. If detection cannot meet that gate, retain this as a supply-chain threat model and require stronger provenance plus sandboxed downstream evaluation rather than claiming a detector.

No autonomous merge, deployment, model promotion, credential escalation, evaluator mutation, or irreversible migration.

Start by locating the existing WorldGraph, Dream Machine, MetaHarness, RVF, RVM, RuView, and RuField provenance boundaries referenced in the issue; no specific files or tests are named. Define the isolated qualification experiment and record checkpoint provenance, clean and triggered results, repair cost, latency, GPU hours, and variance. Done means meeting the 95% detection and below-5% false-reject gate, or documenting why the detector is infeasible and retaining the stated supply-chain controls.