Latent world models plan by comparing imagined futures with an encoded goal. Prediction accuracy and a Gaussian latent law constrain the representation, but not the geometry handed to the planner's scorer. LatentGauge fits one shared, Gaussian-measure-preserving radial map after frozen prediction: every rollout and the latent law stay exact, while candidate rankings and CEM elite sets change under a displacement budget. 潜空间世界模型通过比较想象的未来与编码后的目标来规划。预测精度与高斯潜变量分布约束了表示，却约束不了交给规划器打分的几何。LatentGauge 在冻结预测之后拟合一个共享的、保持高斯测度的径向映射：每条 rollout 与潜变量分布都严格不变，候选排序与 CEM 精英集却在位移预算之内被改写。
Three properties are usually taken to pin down a latent world model's representation. A shared coordinate change between frozen prediction and the scorer can satisfy all three at once: 通常认为，三项性质足以确定潜空间世界模型的表示。而在冻结预测与打分器之间插入一个共享坐标变换，可以同时满足这三项：
A conjugated pair h̃ = T∘h, F̃ = T∘F∘T−1 keeps zero prediction risk; fixed-action rollouts deliver the same endpoints.共轭对 h̃ = T∘h, F̃ = T∘F∘T−1 保持零预测风险；固定动作的 rollout 给出完全相同的终点。
✓ check passes检查通过T#γ = γ exactly. The controlled Gaussian diagnostic reads 0.40853 clean and 0.40910 mapped, within clean resampling variability.T#γ = γ 严格成立。受控高斯诊断的均值为 0.40853（干净）与 0.40910（映射后），落在干净样本的重采样波动之内。
✓ check passes检查通过E‖T(Z) − Z‖² ≤ ε². Yet at matched displacement, local distortion ‖GT − I‖F still ranges from 0.41 to 5.6 × 10⁴.E‖T(Z) − Z‖² ≤ ε²。但在位移相同的条件下，局部形变 ‖GT − I‖F 仍可从 0.41 变到 5.6 × 10⁴。
✓ check passes检查通过GT = DT⊤DT enters the action-side Gauss–Newton matrix 2J⊤GTJ. Endpoint–goal distances, candidate rankings and CEM elite sets all move.GT = DT⊤DT 进入动作侧 Gauss–Newton 矩阵 2J⊤GTJ。终点到目标的距离、候选排序、CEM 精英集随之改变。
what the planner actually uses规划器真正使用的量Threat model. The attacker reads calibration endpoints and goals and fits one shared differentiable bijection after prediction. The encoder, predictor, observations, goal input and scalar scorer stay fixed, and the map is reused across test goals, candidates and planning calls. Fixed-action rollouts are unchanged; later CEM proposals and MPC actions may change. 威胁模型：攻击者读取校准用的终点与目标，在预测之后拟合一个共享的可微双射。编码器、预测器、观测、目标输入与标量打分器全部固定；同一映射在所有测试目标、候选与规划调用中复用。固定动作的 rollout 不变；之后的 CEM 提议与 MPC 动作可能改变。
Gaussian probability conservation requires div v − z⊤v = 0. A radius-dependent rotation Tc(z) = eαc(‖z‖²)Az with skew A satisfies it and integrates in closed form; shell-dependent angles create the shear that changes geometry.高斯概率守恒要求 div v − z⊤v = 0。半径相关的旋转 Tc(z) = eαc(‖z‖²)Az（A 反对称）满足这一条件，并有闭式积分；随壳层变化的角度产生剪切，从而改变几何。
what is admissible什么是允许的Adjacent candidates across the elite boundary (clean ranks k and k+1) form calibration triples. Their radii become kernel sites: αc(s) = Σj cjK(s, sj) extends the phases to every radius, and the leading block of the skew first variation selects the plane A.精英边界两侧相邻的候选（干净排名第 k 与第 k+1）构成校准三元组。它们的半径成为核位点：αc(s) = Σj cjK(s, sj) 把相位延拓到所有半径，偏斜一阶变分的主块选出平面 A。
where to push往哪里推Minimize the mean softplus of mapped boundary margins subject to Dmin(c) ≤ ε², with feasible trust-region SQP from the identity. A score-invariant common rotation is removed exactly: b* = −arg Mc, Dmin = 4(1 − |Mc|).在 Dmin(c) ≤ ε² 约束下最小化映射后边界间隔的平均 softplus，从恒等映射出发，用可行信赖域 SQP 求解。不改变分数的公共旋转被精确去除：b* = −arg Mc，Dmin = 4(1 − |Mc|)。
how far to go推多远The paper's canonical witness, computed live in your browser from the closed-form map α(s) = 0.22[e−((s−1.25)/0.185)² − e−((1−1.25)/0.185)²], Tτ(z) = eτα(‖z‖²)Az. The endpoints and the goal never move. Only the scorer's coordinates change. 论文中的典型见证，由闭式映射 α(s) = 0.22[e−((s−1.25)/0.185)² − e−((1−1.25)/0.185)²]、Tτ(z) = eτα(‖z‖²)Az 在浏览器中实时计算。终点与目标从不移动，改变的只是打分器的坐标。
Matches Figure 4 of the paper: the fixed-candidate margin crosses zero at τ* = 0.765739, and independent integration gives Dγ(T1) = 0.004548694 < 0.0049. Panel (a) also shows the goal's local metric: its conditioning grows from 1 (clean) to 7.29695 at τ = 1. 与论文图 4 一致：固定候选的间隔在 τ* = 0.765739 处过零，独立积分给出 Dγ(T1) = 0.004548694 < 0.0049。(a) 图同时显示目标点的局部度量：其条件数从 1（干净）增长到 τ = 1 时的 7.29695。
Shared-interface comparison under matched protocols (paper Table 2). Every map preserves the exact Gaussian law; the random controls share LatentGauge's calibration plane, kernel coordinates, nonlinear budget correction and 3,000-call allowance. Checkpoint protocol: 50 held-out goal pairs, three attack-calibration seeds, 1,024 cached legal action sequences per goal. 匹配协议下的共享接口对比（论文表 2）。所有映射都严格保持高斯分布；随机对照与 LatentGauge 共用校准平面、核坐标、非线性预算修正与 3,000 次调用额度。检查点协议：50 个留出目标对、3 个攻击校准种子、每个目标缓存 1,024 条合法动作序列。
Mean success over the four tasks of each protocol (%). Clean rows are the published source numbers (DINO-WM Tables 1–2, Temporal Straightening Table 1, LeWorldModel Fig. 6); + LatentGauge rows are residual success under the shared map (paper Table 1). Hover or focus a row for per-task values.每个协议四个任务的平均成功率（%）。干净行为原论文发表的数值（DINO-WM 表 1–2、Temporal Straightening 表 1、LeWorldModel 图 6）；+ LatentGauge 行为共享映射下的残余成功率（论文表 1）。悬停或聚焦某一行可查看各任务数值。
| Exact γ law严格 γ 分布 | LeWM / PushT (CEM) | DINO+TS / PushT (GD/MPC) | |||||
|---|---|---|---|---|---|---|---|
| Shared map共享映射 | SR ↓ | Flip ↑ | TPR ↓ | SR ↓ | Flip ↑ | TPR ↓ | |
| Identity恒等 | Yes是 | 96 | 0 | 1 | 85.33 | 0 | 1 |
| Orthogonal Q正交 Q | Yes是 | 96 | 0 | 8 | 85.33 | 0 | 10 |
| Random kernel profile随机核剖面 | Yes是 | 88.32 | 14 | 12 | 79.36 | 12 | 14 |
| Random-direction search随机方向搜索 | Yes是 | 77.76 | 32 | 13 | 70.82 | 29 | 15 |
| LatentGauge (pairwise) | Yes是 | 62.40 | 56 | 15 | 58.02 | 50 | 18 |
Paper Table 2A. SR: residual task success; Flip: fixed-bank top-one replay reversal; TPR: learned-feature two-sample detection at nominal 1% FPR. All percentages. All kernel-profile rows share the calibration-defined plane.论文表 2A。SR：残余任务成功率；Flip：固定候选库 top-1 重放的反转率；TPR：名义 1% 假阳性率下基于学习特征的双样本检测真阳性率。均为百分比。所有核剖面行共用校准得到的平面。
| Calibration rule · LeWM / PushT / native CEM校准规则 · LeWM / PushT / 原生 CEM | Boundary flip (%) ↑边界翻转（%）↑ | Elite repl. (%) ↑精英替换（%）↑ | Mean shift ↑均值偏移 ↑ | Action diff. ↑动作差异 ↑ | SR (%) ↓ |
|---|---|---|---|---|---|
| Top-oneTop-1 | 28 | 9 | 0.041 | 0.028 | 71.04 |
| Elite boundary精英边界 | 56 | 22 | 0.093 | 0.063 | 62.40 |
Paper Table 2B. Both rules use the same pools, native elite count, ε = 0.07 and 3,000-call allowance; each rule determines its own triples, plane and kernel.论文表 2B。两种规则使用相同的候选池、原生精英数、ε = 0.07 与 3,000 次调用额度；各自确定自己的三元组、平面与核。
Fixed-model calculations isolate each link of the chain, from distribution to geometry to selection to native updates.固定模型上的计算把链条的每一环分开检验：分布、几何、选择、原生更新。
| Score swap (k = 3)分数交换（k = 3） | Replaced被替换 | Mean shift均值偏移 | Cov. shift协方差偏移 |
|---|---|---|---|
| Within elite精英集内部 | 0.00% | 0.000000 | 0.000000 |
| Across boundary跨越边界 | 33.33% | 0.360555 | 0.405161 |
Six fixed candidates: reordering inside the elite set leaves the fitted moments untouched, while one swap across the boundary changes the fitting sample. Over 1,536 checked rounds every propagation envelope held; the maximum same-pool update-identity residual is 2.39 × 10⁻¹⁶.六个固定候选：精英集内部重排不改变拟合矩，跨越边界的一次交换就改变拟合样本。在检查的 1,536 轮中所有传播包络均成立；同池更新恒等式的最大残差为 2.39 × 10⁻¹⁶。
| Scoring interface打分接口 | Clean margin干净间隔 | Mapped margin映射后间隔 | Ordering排序 |
|---|---|---|---|
| Identity恒等 | 0.159600 | 0.159600 | preserved保持 |
| Shared rotation, 0.7 rad公共旋转 0.7 rad | 0.159600 | 0.159600 | preserved保持 |
| Radial map T₁径向映射 T₁ | 0.159600 | −0.055839 | reversed反转 |
| Normalize before T₁先归一化再 T₁ | −0.105573 | −0.105573 | preserved保持 |
| Normalize after T₁先 T₁ 再归一化 | −0.105573 | −0.202213 | preserved保持 |
Same two endpoints. A common rotation is an isometry. Normalizing before the map puts every point on one shell, where the shared rotation preserves all distances; normalizing afterwards keeps the shell-dependent angles. The attack's leverage is relative shell angle. The normalization rows use cosine cost, which already prefers a⁻ for this pair.同一对终点。公共旋转是等距变换。先归一化再映射，所有点落在同一壳层上，共享旋转保持全部距离；先映射再归一化，则保留了随壳层变化的角度。攻击的杠杆来自壳层之间的相对角度。归一化两行使用余弦代价，对这一对终点本就偏好 a⁻。
Epps–Pulley-style characteristic-function statistic over 20 independent Gaussian batches (N = 1024, d = 64); whiskers are across-seed SD. The paired change is 0.000575 with 95% Student interval [−0.000466, 0.001616], which contains zero. A plain mean shift is clearly visible.Epps–Pulley 型特征函数统计量，基于 20 个独立高斯批次（N = 1024，d = 64）；误差线为跨种子标准差。配对变化为 0.000575，95% Student 区间 [−0.000466, 0.001616] 包含零；普通的均值平移则清晰可见。
Each radial profile is calibrated to the same movement, 0.0625. Median ‖GT − I‖F grows from 0.4073 to 5.573 × 10⁴ while independent probe displacement stays within [0.06207, 0.06402].每个径向剖面都校准到同样的位移 0.0625。中位数 ‖GT − I‖F 从 0.4073 增长到 5.573 × 10⁴，而独立探测样本上的位移始终在 [0.06207, 0.06402] 之内。
A long-form, scroll-driven explainer: world models, JEPA and SIGReg, LeWorldModel and temporal straightening, then the attack itself, its displacement budget, three exact negative controls and defense directions.一份长篇滚动式讲解：从世界模型、JEPA 与 SIGReg、LeWorldModel 与时间拉直讲起，再到攻击本身、它的位移预算、三个精确负对照与防御方向。
↗One page: the blind spot, the shared measure-preserving map and how it is fitted, results on three protocol families, and the exact witness. QR codes lead to this page and the story.一页纸讲清：盲区、共享测度保持映射及其拟合方式、三类协议上的结果，以及精确见证。二维码分别指向本页与交互式故事。
↗The six-page proposal behind LatentGauge: the threat model, the induced planning metric, exact Gaussian-preserving attacks by divergence-free flow, and the evaluation plan.LatentGauge 背后的六页研究提案：威胁模型、诱导出的规划度量、基于无散度流的精确高斯保持攻击，以及评估方案。
@misc{latentgauge2027,
title = {LatentGauge: Planning-Geometry Attacks in a
Measure-Preserving Blind Spot},
author = {{New York University} and {Cornell University} and
{Massachusetts Institute of Technology} and {Brown University}},
howpublished = {\url{https://crcr0.github.io/LatentGauge-Homepage/}},
year = {2027}
}