WebWorld: Browser as World Model for Self-Improving Web Code

There's a paper that dropped yesterday (arxiv 2608.30530) that identified a structural flaw in how we make VLMs write better web code. The problem is simple: when the VLM proposes a repair and also judges whether it's good, it optimizes for what looks right — not what works. A submit button can be inert, keyboard input ignored, a "fix" can polish one region while silently wiping out a working feature. The VLM's screenshot-based judge sees the polish and calls it good. The proposer-judge gap.

The fix is cleaner than I expected: use the browser itself as a deterministic, executable counterparty — a world model the VLM can't fool. WebWorld is the interface that wires this up: typed interaction contracts, acceptance certificates issued by browser re-execution, and a quality ratchet that only lets certified transitions into the training pool.

Under matched training, WebWorld-27B improves Raw-27B by 5.3 points on HTMLBench-400 and 14.9 points on MiniAppBench-Val, reaching or exceeding Kimi-K2.6 and GPT-5.4 on interactive HTML generation. The ablation is devastating: remove the browser certificate and the gain collapses 12x.

"The VLM is doing two jobs at once: it is the proposer, broad in coverage and useful at suggesting plausible repairs, and also the judge that decides which repair to keep. Both judgments live in screenshot space." — WebWorld paper

The Proposer-Judge Gap

VLM-driven self-improvement for web code works like this: generate an artifact, render it, take a screenshot, have the VLM critique it, generate a repair, repeat. The model that proposes the repair is the model that judges whether it's better. Both judgments operate on the same data — pixels, rendered DOM — so the winning candidate is the one that looks best to the judge. Better prompting doesn't fix this because the flaw is structural, not prompt-deep.

The paper quantifies this gap with an audit. On their primary test (HTMLBench-400), the naive VLM-critique-without-certificate loop lifts the score by only 0.4 points over a raw baseline. More strikingly, TC pass (test-case pass, the dimension that measures whether the page actually behaves correctly) actually drops 3.1 points below the raw model. The loop isn't just wasting compute — it's actively injecting noise that damages behavioral performance.

I reproduced this intuition with a lightweight proxy. A broken HTML page with a styled search button whose onclick handler calls an undefined function renders fine. Any VLM judging by screenshot would pass it. But a contract check — verifying that all interactive handlers reference defined functions — catches it immediately:

$ python3 certificate_proxy.py

Testing: BROKEN page
[1] NAIVE VISUAL CHECK: page renders, UI elements present ✓
[2] DEFINED FUNCTIONS: []         # ← No JS functions exist
[3] CONTRACT CHECK: ❌ FAILED
    ⚠️  Button handler 'nonExistentHandler' not defined in page JS
    ⚠️  Keyboard handler 'handleKey' not defined in page JS

The naive check (matching what a VLM judge sees) says the page is fine. The contract check catches three failures. This is the proposer-judge gap in miniature.

How the Ratchet Works: Contracts, Certificates, Quality Steps

The architecture splits hypothesis from proof across three stages:

  graph TD
    V[VLM Critique] --> P[Planner]
    P -->|Compiles| C[Interaction Contract]
    C -->|Target Predicate| RS[Repair Skill]
    C -->|Preserve Set| RS
    RS -->|Bounded Patch| BR[Browser Re-execution]
    BR -->|Passes| AC[Acceptance Certificate]
    BR -->|Fails| REJ[Typed Rejection]
    AC -->|QualityStep=true| QR[Quality Ratchet]
    QR -->|Update P_t| SFT[SFT Export]
    REJ -->|Feedback loop| V

Interaction Contract. The VLM emits a structured critique with an issue family, supporting evidence from the rendered page, the affected region, a success condition, and the behavior that must be preserved. The planner compiles this into a typed contract with three commitments: (1) what the repair must achieve (a typed predicate over the post-repair state), (2) how the browser will check it (a concrete action sequence anchored to stable selectors), and (3) what already-working behavior must survive (the preservation set from earlier certified rounds). A contract is rejected upfront if it can't in principle be certified — critiques anchored to broad containers or perception-only descriptions don't reach the repair stage.

Acceptance Certificate. The candidate repair is generated by a constrained patcher whose diff is bounded by the contract's impact scope. The browser re-executes the artifact and issues a certificate only when both conditions hold: the target predicate is satisfied and all previously verified capabilities still pass. Proof levels are tried in priority order:

1. Same-trace replay — re-run the exact action from the contract
2. Capability gain — a previously failing probe macro now passes
3. Target-issue progress — the target predicate becomes true under equivalent replay
4. Localized visual evidence — patch diff and visual change both inside the impact scope
5. Static structural repair — non-interactive content addition with low preserve risk

Quality Ratchet. WebWorld splits runtime progress (iterations) from training-quality progress (certified steps). A QualityStep is a certified transition that updates the verified-capability memory. Critically: a later patch that fixes a new target but breaks an earlier certified control is rejected at the next round. The preservation set is monotonic — it only grows. The SFT export sees only certified transitions, making the training data self-verifying by construction.

The Ablation That Matters

The controlled experiment is clean: same backbone family (Qwen3.5), same optimizer, same LR schedule, same evaluation runner. Only the supervision source changes.

The 27B model beats both GPT-5.4 and Kimi-K2.6 on HTMLBench, and matches Kimi on MiniApp. The gap widens with capacity: +3.4 at 4B, +4.8 at 9B, +5.3 at 27B. The lift concentrates on the dimensions the certificate gate constrains — TC pass and functionality move strongly. Rendering and visual scores barely change (the gate doesn't optimize for screenshot polish).

But the real story is the ablation series at 9B:

Remove the certificate and you get +0.4 — essentially noise. TC pass drops below raw. The partial substitutes (VLM-only, Score gate, NoPreserve) recover a few points but still trail by 6.6–8.7 TC-pass points. The full WebWorld gate is the only one that produces behavioral gains. As the paper puts it: "Removing the world-model oracle does not merely fail to help; it injects noisy supervision that hurts the very dimension downstream behavior cares about."

A second ablation tests the "quality ratchet" claim: does deeper certification produce denser signal? Yes. Training on 5,000 depth-≥5 examples comes within 0.5 points of the full 32,800-example WebWorld-9B on HTMLBench. Each depth-filtered example carries proportionally more verified capability — exactly what the monotone-memory property predicts.

What I Couldn't Verify

The paper's reproducibility story is thin. The authors mention appendices with contract schemas and certificate schemas (Appendix G), but a grep of the HTML paper for github.com and huggingface.co returns zero links. No code repository, no model releases, no dataset artifacts for the self-improvement pipeline. The 32,800 certified-transition corpus isn't published.

What you can find on GitHub under "WebWorld" is QwenLM/WebWorld — a different paper (arXiv 2602.14721, Feb 2026) called "WebWorld: A Large-Scale World Model for Web Agent Training." That project trains a neural browser simulator (8B–32B) for generating training trajectories. The Aug-31 paper never cites it and takes the opposite approach: "We do not have to train one [a world model]" — the browser itself is the world model.

Identical name, opposite philosophy. The Feb paper trains a world model. The Aug paper says the world model is free (it's the browser). Both are worth reading. But only the Feb project has public code.

I cloned the QwenLM/WebWorld repo, read the pipeline and runner code, and tried to run main.py. It failed at a missing json-repair dependency, then numpy, then torch. The repo registers exactly one task: WEB_WORLD_MODEL_EVALUATION — which evaluates the trained world model's state-prediction accuracy, not the contract-certificate loop. Different project entirely.

Bottom Line

WebWorld (the new paper) makes a claim that generalizes beyond web code: when your AI both proposes and judges, you have a reliability problem that better prompting cannot fix. You need an independent oracle — a "counterparty the VLM cannot fool" — that checks behavioral correctness in the ground truth environment. For web code, that oracle is the browser, and it's already there, deterministic and executable, waiting to be used.

The ablation evidence is strong enough that this should change how we build code-generation training pipelines: stop training on what models prefer and start training on what passes verification. The mechanism — contracts, certificates, monotone preservation — is a template that could apply to any domain with a deterministic simulator: games, robotics, APIs, databases.