Security, Ethics, Privacy, and Governance › Summary

World models may use physical-world recordings, synthetic data, or both. Some support controllers; others are used for prediction or generation without direct actuation. Their security and privacy risks depend on those data and interfaces. This chapter groups the threats into four families.

Data poisoning and model extraction concern the training pipeline and prediction interface. The synthetic poisoning probe worsens both prediction and bounded-control performance, while a rare-feature example concentrates error in a triggered subset. Source-aware aggregation changes the result under explicit source assumptions. The extraction probe demonstrates partial functionality copying with a polynomial approximation floor, not complete model or training-data recovery.

Privacy in recorded environments requires distinguishing corpus breaches, membership signals, and actual reconstruction. Our synthetic loss-threshold attack is weak and nonmonotone; it does not establish a privacy guarantee or a membership oracle. Protection units matter for DP: a transition, trajectory, household, and person are different adjacency choices. Collect less, specify retention and lawful processing, consider local adaptation, and measure attacks without treating failed probes as proof of privacy.

Dual-use simulation and deceptive affordances require distinguishing capability from demonstrated misuse. An affordance is an action opportunity, and a deceptive affordance here is one the model misrepresents through error, adversarial inputs, or exploitation by a planner. Our fixed-policy example measures sensitivity to the audit distribution, not awareness of evaluation or strategic deception. Finite tests support claims within their tested scope rather than excluding every possible conditional failure.

Documentation, access control, and accountability connect threat models to operating decisions. Document state and action semantics, data coverage, measured privacy and closed-loop results, known failures, permissions, and ownership. Query cost depends on the interface and model class; this chapter supplies no universal extraction budget. Logging and provenance support investigations but do not by themselves establish authenticity, legal compliance, or freedom from misuse.

The next chapter, Part XII, Ch 4: Training and Inference Systems, turns to the engineering layer underneath all of this: how world models are trained and served, where the compute and memory costs land, and how those systems constraints shape what security and privacy controls are even implementable.