Predictive Safety Illusions: How World-Model AI Can Be Both Shield and Attack Surface

A warehouse robot rolls toward a pallet. Its cameras see a clean floor. Its planner picks a path. The model the robot uses to imagine the next few seconds of its world has been quietly corrupted, and the cameras and planner cannot tell. The path it picks looks safe because the imagination behind it is no longer trustworthy. The robot still "sees" a safe run.

That is the failure mode the survey "Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation" calls a predictive safety illusion: a plan that looks safe to the system because the model it used to imagine the future has been poisoned, backdoored, or over-trusted. The paper's authors argue this is the shape physical-AI breaches will take, and that the field's security conversation is still anchored to the wrong layer of the stack.

Two terms anchor the shift. A world model is the AI component that compresses a robot's observations into internal states and simulates action-conditioned futures before the robot commits to a move. It is the planner's imagination. Embodied AI is the broader category: any AI that controls a physical system, including a warehouse robot, a self-driving car, a drone, or a humanoid helper at home. The interesting systems are no longer reactive. They predict.

A spoofed floor marker, a tampered camera feed, a poisoned training set, or a backdoored representation-learning module can corrupt the world model itself, so the system imagines a safe world that no longer exists. Traditional defenses that watch the sensor stream or the actuator commands do not catch this, because the corruption lives one level up, in the predictions the robot uses to act.

World models can also act as a runtime safety shield, running imagined futures against safety constraints before the robot moves and flagging trajectories that would lead to a collision, a fall, or a hazardous zone. That makes them a candidate safety tool. It also makes them a new attack surface. When the shield is compromised or trusted too much, the system produces a confidently unsafe plan.

The survey maps the threat across the full lifecycle in five stages. Data construction and representation learning, where poisoning and backdoors enter. State grounding and imagination, where adversarial examples and sensor spoofing bend the model's internal picture of the world. Trajectory evaluation, where the planned sequences of action the model produces are themselves manipulated. Execution, where commands reach actuators. Long-term adaptation, where memory and tool use extend the model's reach over time. Each stage exposes a different attack family, and each attack family maps to a property the world model is supposed to preserve.

The authors group countermeasures into six families: provenance for the data and models that feed the world model, robust grounding of states to the physical world, uncertainty-aware prediction so the system can refuse to act on low-confidence imagination, trajectory gating that blocks unsafe imagined paths before execution, feedback auditing of long-running adaptation, and deployment assurance. The paper flags each as underbaked. The research community does not yet know how to detect a compromised world model reliably, does not have standardized benchmarks for measuring predictive safety illusions, and has no agreed protocol for when a system should refuse to act because its imagination is untrusted.

That last gap is the one to watch. A sensor failure produces a noisy, easy-to-notice error. A world-model failure produces a clean, confident plan that is wrong in a way the system cannot flag from inside. The next physical-AI incident, when it happens, is unlikely to look like a robot hitting a wall. It is more likely to look like a robot that, on paper, did everything right and still rolled into the wrong place.

The survey is an arXiv preprint (v1, 30 Jul 2026) and a field map rather than a breach report. It does not document a specific incident, and the authors are careful to position predictive safety illusions as a failure mode the field should prepare for, not as a confirmed attack pattern. Read it as a warning shot and a research agenda. The security boundary for embodied AI has moved from sensors to predictions, and the defenses have not yet caught up.