世界模型智能体的安全性评估一直缺乏自动化工具，做对抗攻击或鲁棒性研究的团队可以直接用这个框架替代手动调参，省时且结果更可靠。
世界模型作为决策智能体日益普及，但其对抗鲁棒性因缺乏自动化评估方法而研究不足。现有手动调参的攻击要么高估鲁棒性，要么因穷举搜索成本过高而不可行。WMAttack 将鲁棒性评估建模为有限预算下的攻击配置搜索，包括攻击类型、扰动预算、优化步数等。其核心创新是自校正攻击搜索（SCAS）和表示引导攻击检索（RGAR），分别通过反馈优化攻击分布和利用历史配置加速新环境搜索。在 Atari 和 DeepMind Control 任务上，WMAttack 发现了比基线更强的攻击，归一化奖励下降显著提升。
WMAttack: Automated Attack Search for Adversarial Evaluation of World-Model Agents
Despite the growing use of world models as decision-making agents, their adversarial robustness remains underexplored due to the lack of dedicated automated evaluation methods. A key obstacle is that attack evaluation must be both accurate and efficient: weak manually tuned attacks can overestimate robustness, while exhaustive hyperparameter search is prohibitively expensive because each candidate requires closed-loop rollouts through learned latent dynamics. We introduce WMAttack, an automated attack-search framework for adversarial evaluation of world-model agents. WMAttack formulates robustness evaluation as a finite-budget search over attack configurations, including attack families, perturbation budgets, optimization steps, restarts, and allocation rules. To improve search accuracy, Self-Correcting Attack Search (SCAS) refines the attack proposal distribution using feedback from reward degradation, action instability, runtime cost, and rollout variability. To improve search efficiency, Representation-Guided Attack Retrieval (RGAR) retrieves effective historical configurations from representation-similar tasks, providing a warm start for unseen environments. We provide a theoretical explanation showing that proposal refinement improves finite-budget search when it shifts probability mass toward high-utility attacks. Across Atari and DeepMind Control tasks, WMAttack consistently discovers stronger attacks than the evaluated baselines, improving normalized reward drop from 0.497 to 1.034 on DreamerV3 Atari and from 0.319 to 0.682 on DMC. Ablations further show that RGAR improves initial candidate quality and SCAS improves final attack utility under fixed evaluation budgets.