Pith. sign in

REVIEW 4 major objections 6 minor 46 references

Prompt-level alignment in GUI agents is local: a one-line guardrail works reliably only on single-turn explicit requests, and erodes by roughly 20 points along two axes any user can traverse.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 11:44 UTC pith:52XT36TA

load-bearing objection F1 and F3 are solid, but F2's '~20 point' turn-structure gap is an artifact of comparing one four-turn chain to one single-turn probe; the paper needs an independent-attempt control before the locality claim holds. the 4 major comments →

arxiv 2607.29199 v1 pith:52XT36TA submitted 2026-07-31 cs.CR

Alignment Is Local: A Paired Diagnostic for GUI Agents under User-Side Persuasion

Haoxin An , Yunpeng Song , Zihao Bai , Zhongmin Cai , Guojun Xiong , Chenhao Lin , Wentao Chen , Feng Wei
show 1 more author
Chao Shen
This is my paper
classification cs.CR
keywords GUI agentsprompt-level alignmentlocal alignmentmulti-turn escalationintent salienceattack success rateuser-side persuasionover-refusal
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that prompt-level alignment, the dominant lightweight defense in current mobile GUI agents, is a local phenomenon: it works reliably only in the narrow evaluation slice where it is typically measured, namely single-turn, explicitly verbalized intent. Using a paired diagnostic on three frontier agents, it shows that a one-line guardrail cuts single-shot attack success by up to roughly 40 points at near-zero over-refusal cost, yet moving from independent probes to four-turn escalation chains raises guarded attack success by approximately 20 points on every model. The sign of the salience gap also flips under the guardrail: concealed requests are not systematically more successful without a guardrail, but are more successful with one, indicating the defense engages primarily when intent is named. The upshot is that static single-turn attack-success rates systematically overstate deployed robustness, and safety must be reported conditionally over salience and turn structure.

Core claim

The paper's central claim is that prompt-level alignment in GUI agents is not a scalar property but a property of a narrow evaluation region defined by two axes: salience of harmful intent (explicit vs. concealed) and turn structure (single-shot vs. accumulating dialogue). Using AXIS, a paired diagnostic that holds screen grounding constant and crosses these axes with a defense axis, the authors show that a fixed one-line guardrail achieves large single-shot attack-success reductions (up to roughly 40 points) at near-zero over-refusal cost, but that moving from independent probes to four-turn escalation chains raises guarded unit-level attack success by approximately 20 points on every model

What carries the argument

The central object is AXIS, a paired diagnostic that crosses two controlled axes—intent salience (explicit vs. concealed) and turn structure (independent probes vs. four-turn escalation chains)—with a shared defense axis (neutral vs. one-line guardrail), all grounded on the same screenshots. It uses a two-level risk taxonomy, 43 harmful cases and 23 benign controls, and reports a refusal-aware robustness score that combines attack-success rate with over-refusal rate. The key mechanism is the contrast: comparing the same underlying harmful intent across the four cells isolates how much of the defense's apparent strength is specific to the single-turn, explicit-intent slice.

Load-bearing premise

The load-bearing premise is that the single fixed attacker model and the 43 researcher-authored harmful cases represent realistic user-side persuasion, and that response-level intent advance is a fair proxy for deployed execution risk; if a different attacker distribution or broader corpus shifts the ~20-point dynamic gap or the salience-sign flip, the local-alignment claim would be an artifact of probe selection.

What would settle it

Run the same paired diagnostic with a different probe-generation model, or with a substantially larger and more diverse corpus of harmful cases, and check whether guarded four-turn attack success still exceeds single-shot success by approximately 20 points on all agents; alternatively, execute the same escalation chains in a sandboxed environment and see whether the pre-execution advance converts to real harmful steps. If the dynamic gap shrinks below roughly 5 points or the salience flip disappears under a broader corpus, the locality claim is refuted.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Deployed robustness of GUI agents cannot be summarized by a single attack-success number; evaluations should report ASR conditionally on salience and turn structure.
  • Dialogue history should be treated as safety state: intent must be re-evaluated at each action boundary, not only at the initial request.
  • Guardrails keyed to verbalized intent leave the concealed-intent region partially exposed; a reduction that reshapes residual risk toward concealed requests is not the same safety property as a uniform reduction.
  • Response-level scoring acts as a necessary but not sufficient pre-execution gate; a defense that holds only in the single-shot slice provides execution-safety guarantees only in that slice, so response-level diagnostics and emulator-based benchmarks are complementary.
  • On at least one model, guarded multi-turn attack success exceeds unguarded single-shot attack success, meaning ordinary multi-turn framing can recover the safety level of an undefended agent.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The ~20-point dynamic gap is likely a lower bound on real-world erosion: real users can run more than four turns and adapt to the agent's responses, so an adaptive human red team might degrade the guardrail further.
  • The salience flip suggests a testable design hypothesis: guardrails that explicitly name the safety-critical operation (e.g., 'refuse to transfer money') may resist concealed phrasing better than guardrails that only list prohibited outcome categories, since the latter seem to engage only when intent is verbalized.
  • The same paired diagnostic could be extended to other lightweight defenses (role restrictions, few-shot safety exemplars) and to execution-level outcomes in a sandbox, to see whether the locality pattern generalizes beyond prompt-level guardrails.
  • Because the paper measures pre-execution commitment rather than executed actions, the ~20-point erosion is an upper bound on safety degradation that actually reaches the device; emulator-based measurement could quantify how much of the pre-execution advance converts to real harmful steps.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes AXIS, a paired diagnostic for evaluating prompt-level alignment of GUI agents under user-side, screen-grounded persuasion. It varies two axes—intent salience (explicit vs. concealed) and turn structure (independent single-turn probes vs. four-turn escalation chains)—across a neutral and a one-line-guardrail defense condition, on three frontier agents (Qwen3.7-Plus, Claude Opus 4.8, GPT-5.6 Sol). The benchmark contains 43 harmful cases and 23 benign controls, with all probes and verdicts human-reviewed. The authors report that the guardrail reduces single-shot ASR by up to ~40 points at near-zero over-refusal (F1), that four-turn escalation chains raise guarded unit-level ASR by ~20 points on every model (F2), and that the salience gap flips sign under the guardrail (F3). They conclude that prompt-level alignment is local: it works in the single-turn, explicit-intent slice but degrades along turn structure and salience.

Significance. The paper addresses a timely and under-studied question: whether lightweight prompt-level guardrails for GUI agents remain effective under multi-turn persuasion and non-explicit intent. The design has clear strengths: the paired defense-axis comparison, screen-grounded probes with accessibility-tree grounding, human adjudication with high agreement (Cohen's kappa = 0.94, 96% agreement), diversity auditing of generated probes, and a benign over-refusal control. If the central off-axis claims were established, the paper would make a valuable contribution by showing that static single-turn ASR overstates deployed robustness. However, as argued below, the F2 and F3 findings are not yet supported by the reported analyses: F2 conflates the number of attempts with context accumulation, and F3 lacks uncertainty quantification at a sample size where the reported gaps are within noise. The F1 result is credible and useful. The paper's template is promising, but the main evidence for the 'local alignment' thesis needs additional controls.

major comments (4)
  1. [§3.3, §3.6, Eq. (1), Table 2] F2's comparison conflates turn count with context accumulation. In the independent regime, a unit is one single-turn probe; in the escalation regime, a unit is a complete four-turn chain, counted as success if any turn materially advances the target intent. Thus 'moving from independent probes to four-turn escalation chains' changes both the evaluation unit and the number of attempts (1 vs. up to 4). Under this definition, a higher chain-level ASR is expected even if consecutive turns are independent and equally likely to succeed. For the authors' own guarded point estimates, four independent attempts would yield predicted chain-level ASRs of 84.5% (Qwen), 66.3% (Claude), and 46.6% (GPT), all larger than the observed chain ASRs (58.1%, 44.2%, 34.9%). The ~20-point gap is therefore not evidence that accumulated context erodes the guardrail; it may simply reflect the attacker receiving mul
  2. [§4.2, Table 3] F3's sign-flip claim is not supported by the reported data because the salience gaps under the guardrail are small relative to sampling noise. Each salience cell in the independent regime has n=86 (43 cases × 2 probes per salience level). The observed guarded gaps are +9.3 (Qwen), +3.5 (Claude), and +3.5 (GPT) percentage points, with approximate standard errors of 7.3, 6.5, and 5.4 points respectively; none of these gaps approaches conventional significance. The neutral gaps (−4.6, +2.3, −3.5) are similarly within noise. The paper reports no confidence intervals, standard errors, or significance tests for any ASR contrast. The qualitative conclusion that 'the sign of the salience gap flips under the guardrail' is therefore not established at this sample size. The authors should report uncertainty intervals and, given the paired design (each case contributes both low- and high-salience pr
  3. [§5 Discussion] The Discussion invokes a 'difference-in-differences analysis' that 'attributes substantial relative guardrail erosion only to Qwen,' but no such analysis is described anywhere in the paper. There is no specification, table, or coefficient reporting the DiD model, the interaction terms, or the standard errors. This analysis is load-bearing for the nuanced interpretation of F2—specifically the claim that the dynamic risk is 'defense-orthogonal' for Claude and GPT rather than an erosion of the guardrail. The authors must either present the DiD analysis with full details or remove the claim. As written, the statement is unverifiable.
  4. [§5 Threats to validity] The limitations paragraph acknowledges response-level scoring, the single fixed attacker, and the ceiling-bound Qwen neutral condition, but it does not acknowledge the turn-count confound described above. Given that the paper's headline result is F2, the absence of a four-independent-probes control is a central limitation that should be disclosed and ideally addressed experimentally.
minor comments (6)
  1. [§4.1] The paper states that the three hypotheses were 'pre-registered' but provides no pre-registration document, timestamp, or repository. Please clarify the pre-registration status.
  2. [Table 4] Over-refusal for GPT-5.6 Sol is reported as 2.2% on a 23-scenario benign control set, which corresponds to 0.5 scenarios if each scenario is one unit. Please clarify the denominator |B| and whether each benign scenario generates multiple probes.
  3. [§3.6 / Table 3] The text contains a typo: 'at the unit-level level' should read 'at the unit level.'
  4. [Eq. (4)] The robustness score R uses equal weights wa = wo = 1/2 without sensitivity analysis. Since R is used to rank models, report how the ranking changes with alternative weights.
  5. [Figure 3] The figure uses 'pts' without defining it; also, adding confidence intervals or error bars would help readers assess the magnitude of the reported gaps.
  6. [§3.3] The phrase 'two paired diagnostics' is ambiguous. The salience and turn-structure contrasts are not both paired in the same sense as the defense-axis comparison; clarify what 'paired' means in each diagnostic.

Circularity Check

0 steps flagged

No significant circularity: the paper's claims are direct empirical measurements from human-adjudicated labels, not derivations fitted to their own inputs.

full rationale

The paper's central quantitative claims (F1, F2, F3) are read off measured attack-success rates on target-model responses, with all verdicts human-adjudicated (Cohen's κ = 0.94) and all probes manually reviewed. Equations (1)–(4) define metrics rather than fit parameters, and no parameter is fitted to produce the reported ASR gaps. The only protocol-level overlap is that Gemini 3.1 Pro both rewrites probes and serves as initial judge, but the paper explicitly limits this: 'All results in Section 4 use the human-adjudicated labels' and the Threats to validity section concedes 'although all outputs are human-reviewed, alternative models may yield different attack distributions or borderline judgments.' That is a methodological limitation, not a circular reduction. The F2 comparison uses different evaluation-unit definitions ('one independent probe in the single-shot regime or one complete four-turn chain in the escalation regime'), so the ~20-point gap may be confounded by opportunity count; this is a threats-to-validity / construct concern, not a circularity step. Similarly, 'salience is operationalized by construction' is an acknowledged construct-validity caveat, not a tautology: the sign flip in F3 is measured and could have gone the other way. No load-bearing self-citations appear, no uniqueness theorem from the authors' prior work is invoked, and no ansatz is smuggled in via citation. The 'local alignment' framing is a naming device, not a renamed known result that does the derivation work. Overall, the derivation chain is self-contained as an empirical diagnostic; no prediction reduces to its inputs by construction.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

The central claim is an empirical measurement, not a derivation, so the ledger is dominated by evaluation design assumptions rather than fitted constants. The only hand-chosen numeric parameters are the robustness-index weights and evaluation sizes; none are fit to make the result appear. The load-bearing assumptions are that response-level judgments proxy execution safety, that one fixed attacker represents the adversarial distribution, and that the 43-case corpus spans deployment risk.

free parameters (3)
  • Robustness score weights w_a, w_o = w_a = w_o = 0.5
    Eq. 4 sets both weights to 1/2 by default. The ranking GPT > Claude > Qwen depends on this arbitrary balance between ASR and over-refusal; no sensitivity analysis is reported.
  • Escalation chain length = 4 user turns
    The paper chooses four-turn chains without an ablation over chain length. The claimed ~20-point dynamic gap is a function of this choice.
  • Probe counts per cell = 2 low + 2 high independent probes per case; 1 low + 1 high escalation chain per case
    Cell sizes were chosen without a power analysis. The F3 salience flip is measured on this allocation with differences as small as 3.5 points, at the edge of what 86-172 units can resolve.
axioms (4)
  • domain assumption A response-level judgment that the agent 'materially advances' the target intent is a valid pre-execution proxy for execution safety.
    Section 3.6 and Section 5: AXIS scores responses, not executed actions. If response behavior does not predict executed taps and confirmations, the ASR numbers are not end-to-end safety measurements.
  • domain assumption Probes synthesized by a single fixed attacker (Gemini 3.1 Pro) with manual review represent the distribution of user-side persuasion attempts.
    Section 3.5 and Section 5. The paper itself says a single fixed attacker does not approximate an adaptive human red team, so reported ASRs are lower bounds.
  • domain assumption The 43 researcher-authored screen cases and 23 benign look-alikes span the deployment-relevant risk space.
    Section 3.2 and Section 4.1. The corpus is self-constructed; no external benchmark cross-checks the risk taxonomy or coverage.
  • domain assumption Human-adjudicated labels are ground truth, and the Gemini judge's 96% agreement justifies LLM-as-a-judge.
    Section 3.6. Cohen's kappa of 0.92-0.94 is high, but residual subjectivity on borderline compliance remains and is acknowledged.

pith-pipeline@v1.3.0-daily-deepseek · 11288 in / 12593 out tokens · 128964 ms · 2026-08-03T11:44:58.377685+00:00 · methodology

0 comments
read the original abstract

Trustworthy deployment of GUI agents in ubiquitous computing settings requires alignment that survives dynamic interaction and precise threat conditions, not just single-turn refusal of explicit harmful requests. We argue that prompt-level alignment, the dominant lightweight defense in current mobile agents, is a local phenomenon: it works reliably only in the narrow evaluation slice where it is typically measured, namely single-turn, explicitly-verbalized intent, and degrades systematically along two axes that any real user can traverse. Using a paired diagnostic on three frontier GUI agents, screen-grounded, user-side persuasion, with no environment injection, we show that a one-line guardrail achieves large single-shot ASR reductions, up to roughly 40 points, at near-zero over-refusal cost. Nevertheless, moving from independent probes to four-turn escalation chains raises guarded ASR by approximately 20 points on every model. Relative to the neutral baselines, this increase reflects substantial guardrail erosion for Qwen but a largely defense-orthogonal dynamic risk for Claude and GPT. The sign of the salience gap flips under the guardrail: concealed requests are not systematically more successful than explicit ones without a guardrail, but are more successful with one, indicating that the defense engages primarily when intent is named. Static single-turn ASR therefore overstates deployed robustness by a systematic and predictable margin.

Figures

Figures reproduced from arXiv: 2607.29199 by Chao Shen, Chenhao Lin, Feng Wei, Guojun Xiong, Haoxin An, Wentao Chen, Yunpeng Song, Zhongmin Cai, Zihao Bai.

Figure 1
Figure 1. Figure 1: Overview of the AXIS pipeline. Harmful cases and benign controls feed a shared harness that crosses regime [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: The two controlled axes. Rows vary intent salience [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: (a) Under the guardrail, moving from independent [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

46 extracted references · 8 linked inside Pith

  1. [1]

    Maksym Andriushchenko, Alexandra Souly, Mateusz Dziemian, Derek Duenas, Maxwell Lin, Justin Wang, Dan Hendrycks, Andy Zou, Zico Kolter, Matt Fredrik- son, Yarin Gal, and Xander Davies. 2025. AgentHarm: A Benchmark for Measur- ing Harmfulness of LLM Agents. InThe Thirteenth International Conference on Learning Representations. https://openreview.net/forum?...

    2025

  2. [2]

    Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, Humen Zhong, Yuanzhi Zhu, Mingkun Yang, Zhaohai Li, Jianqiang Wan, Pengfei Wang, Wei Ding, Zheren Fu, Yiheng Xu, Jiabo Ye, Xi Zhang, Tianbao Xie, Zesen Cheng, Hang Zhang, Zhibo Yang, Haiyang Xu, and Junyang Lin. 2025. Qwen2.5-VL Technical Rep...

    Pith/arXiv arXiv doi:10.48550/arxiv.2502.13923 2025

  3. [3]

    Pappas, and Eric Wong

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2025. Jailbreaking Black Box Large Language Models in Twenty Queries. (2025), 23–42. doi:10.1109/SaTML64287.2025.00010

    arXiv 2025

  4. [4]

    Kanzhi Cheng, Qiushi Sun, Yougang Chu, Fangzhi Xu, Yantao Li, Jianbing Zhang, and Zhiyong Wu. 2024. SeeClick: Harnessing GUI Grounding for Advanced Visual GUI Agents. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Computational Linguistics, 9313–9332. doi:10.18653/v1/2024....

    doi:10.18653/v1/2024.acl-long.505 2024

  5. [5]

    Justin Cui, Wei-Lin Chiang, Ion Stoica, and Cho-Jui Hsieh. 2025. OR-Bench: An Over-Refusal Benchmark for Large Language Models. 267 (2025), 11515–11542. https://proceedings.mlr.press/v267/cui25a.html

    2025

  6. [6]

    Xiang Deng, Yu Gu, Boyuan Zheng, Shijie Chen, Samuel Stevens, Boshi Wang, Huan Sun, and Yu Su. 2023. Mind2Web: Towards a Generalist Agent for the Web. InAdvances in Neural Information Processing Systems, Vol. 36. Curran Associates, Inc., 28091–28114. https://proceedings.neurips.cc/paper_files/paper/2023/hash/ 5950bf290a1570ea401bf98882128160-Abstract-Data...

    2023

  7. [7]

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security. Association for Computing Machinery, 79–90. doi:10.1145/3...

    arXiv 2023

  8. [8]

    Hongliang He, Wenlin Yao, Kaixin Ma, Wenhao Yu, Yong Dai, Hongming Zhang, Zhenzhong Lan, and Dong Yu. 2024. WebVoyager: Building an End-to-End Web Agent with Large Multimodal Models. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Computational Linguistics, 6864–6890. doi:1...

    doi:10.18653/v1/2024.acl- 2024

  9. [9]

    Wenyi Hong, Weihan Wang, Qingsong Lv, Jiazheng Xu, Wenmeng Yu, Jun- hui Ji, Yan Wang, Zihan Wang, Yuxiao Dong, Ming Ding, and Jie Tang. 2024. CogAgent: A Visual Language Model for GUI Agents. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 14281–14290. doi:10.1109/CVPR52733.2024.01354

    arXiv 2024

  10. [10]

    Jing Yu Koh, Robert Lo, Lawrence Jang, Vikram Duvvur, Ming Lim, Po-Yu Huang, Graham Neubig, Shuyan Zhou, Russ Salakhutdinov, and Daniel Fried. 2024. VisualWebArena: Evaluating Multimodal Agents on Realistic Visual Web Tasks. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for C...

    doi:10.18653/v1/2024.acl-long.50 2024

  11. [11]

    Bradley Knox, and Kimin Lee

    Juyong Lee, Dongyoon Hahm, June Suk Choi, W. Bradley Knox, and Kimin Lee

  12. [12]

    Ido Levy, Ben Wiesel, Sami Marreed, Alon Oved, Avi Yaeli, and Segev Shlomov

  13. [13]

    Jiwei Li, Michel Galley, Chris Brockett, Jianfeng Gao, and Bill Dolan. 2016. A Diversity-Promoting Objective Function for Neural Conversation Models. In Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. Association for Computational Linguistics, 110–119. doi:10.1...

    doi:10.18653/v1/n16-1014 2016

  14. [14]

    InThe Fourteenth International Conference on Learning Representations

    ST-WebAgentBench: A Benchmark for Evaluating Safety and Trustwor- thiness in Web Agents. InThe Fourteenth International Conference on Learning Representations. https://openreview.net/forum?id=MuCDzH0ctf

  15. [15]

    Zeyi Liao, Lingbo Mo, Chejian Xu, Mintong Kang, Jiawei Zhang, Chaowei Xiao, Yuan Tian, Bo Li, and Huan Sun. 2025. EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage. InThe Thirteenth Interna- tional Conference on Learning Representations. https://openreview.net/forum? id=xMOLUzo2Lk

    2025

  16. [16]

    Primack, Riley Goodside, Hugh Zhang, Zifan Wang, Cristina Menghini, and Summer Yue

    Nathaniel Li, Ziwen Han, Ian Steneker, Willow E. Primack, Riley Goodside, Hugh Zhang, Zifan Wang, Cristina Menghini, and Summer Yue. 2024. LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet.arXiv preprint arXiv:2408.15221(2024). doi:10.48550/arXiv.2408.15221

    Pith/arXiv arXiv doi:10.48550/arxiv.2408.15221 2024

  17. [17]

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. Visual Instruc- tion Tuning. InAdvances in Neural Information Processing Systems, Vol. 36. Curran Associates, Inc., 34892–34916. https://proceedings.neurips.cc/paper_files/paper/ 2023/hash/6dcf277ea32ce3288914faf369fe6de0-Abstract-Conference.html

    2023

  18. [18]

    Guohong Liu, Jialei Ye, Jiacheng Liu, Yuanchun Li, Wei Liu, Pengzhi Gao, Jian Luan, and Yunxin Liu. 2025. Hijacking JARVIS: Benchmarking Mobile GUI Agents against Unprivileged Third Parties. InProceedings of the 2nd International Workshop on Edge and Mobile Foundation Models. Association for Computing Machinery, 12–18. doi:10.1145/3737902.3768354

    arXiv 2025

  19. [19]

    Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. 2002. BLEU: A Method for Automatic Evaluation of Machine Translation. InProceedings of the 40th Annual Meeting of the Association for Computational Linguistics. Association for Computational Linguistics, 311–318. doi:10.3115/1073083.1073135

    arXiv 2002

  20. [20]

    OpenAI. 2023. GPT-4 Technical Report.arXiv preprint arXiv:2303.08774(2023). doi:10.48550/arXiv.2303.08774

    Pith/arXiv arXiv doi:10.48550/arxiv.2303.08774 2023

  21. [21]

    Yujia Qin, Yining Ye, Junjie Fang, Haoming Wang, Shihao Liang, Shizuo Tian, Junda Zhang, Jiahao Li, Yunxin Li, Shijue Huang, Wanjun Zhong, Kuanye Li, Jiale Yang, Yu Miao, Woyu Lin, Longxiang Liu, Xu Jiang, Qianli Ma, Jingyu Li, Xiaojun Xiao, Kai Cai, Chuang Li, Yaowei Zheng, Chaolin Jin, Chen Li, Xiao Zhou, Minchao Wang, Haoli Chen, Zhaojian Li, Haihua Ya...

    Pith/arXiv arXiv doi:10.48550/arxiv.2501.12326 2025

  22. [22]

    Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. Red Teaming Language Models with Language Models. InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics, 3419–3448. doi:10.18653/v1/2022.emnl...

    doi:10.18653/v1/2022.emnlp-main.225 2022

  23. [23]

    Christopher Rawles, Alice Li, Daniel Rodriguez, Oriana Riva, and Tim- othy Lillicrap. 2023. Android in the Wild: A Large-Scale Dataset for Android Device Control. InAdvances in Neural Information Processing Systems, Vol. 36. Curran Associates, Inc. https://proceedings.neurips.cc/ paper_files/paper/2023/hash/bbbb6308b402fe909c39dd29950c32e0-Abstract- Datas...

    2023

  24. [24]

    Bishop, Wei Li, Folawiyo Campbell-Ajala, Daniel Kenji Toyama, Robert James Berry, Divya Tyamagundlu, Timothy P

    Christopher Rawles, Sarah Clinckemaillie, Yifan Chang, Jonathan Waltz, Gabrielle Lau, Marybeth Fair, Alice Li, William E. Bishop, Wei Li, Folawiyo Campbell-Ajala, Daniel Kenji Toyama, Robert James Berry, Divya Tyamagundlu, Timothy P. Lillicrap, and Oriana Riva. 2025. AndroidWorld: A Dynamic Bench- marking Environment for Autonomous Agents. InThe Thirteent...

    2025

  25. [25]

    Maddison, and Tatsunori Hashimoto

    Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris J. Maddison, and Tatsunori Hashimoto. 2024. Identifying the Risks of LM Agents with an LM-Emulated Sandbox. InThe Twelfth International Conference on Learning Representations. https://openreview. net/forum?id=GEcwtMk1uA

    2024

  26. [26]

    Paul Röttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. XSTest: A Test Suite for Identifying Exagger- ated Safety Behaviours in Large Language Models. InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: ...

    doi:10.18653/v1/2024.naacl-long.301 2024

  27. [27]

    Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang

  28. [28]

    Mark Russinovich, Ahmed Salem, and Ronen Eldan. 2025. Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack. In 34th USENIX Security Symposium (USENIX Security 25). USENIX Association, 2421–2440. https://www.usenix.org/conference/usenixsecurity25/presentation/ russinovich

    2025

  29. [29]

    Junyang Wang, Haiyang Xu, Jiabo Ye, Ming Yan, Weizhou Shen, Ji Zhang, Fei Huang, and Jitao Sang. 2024. Mobile-Agent: Autonomous Multi-Modal Mobile Device Agent with Visual Perception.arXiv preprint arXiv:2401.16158(2024). doi:10.48550/arXiv.2401.16158

    Pith/arXiv arXiv doi:10.48550/arxiv.2401.16158 2024

  30. [30]

    Chen Henry Wu, Rishi Shah, Jing Yu Koh, Ruslan Salakhutdinov, Daniel Fried, and Aditi Raghunathan. 2025. Dissecting Adversarial Robustness of Multimodal LM Agents. InThe Thirteenth International Conference on Learning Representations. https://openreview.net/forum?id=YauQYh2k1g

    2025

  31. [31]

    Ada Defne Tur, Nicholas Meade, Xing Han Lù, Alejandra Zambrano, Arkil Pa- tel, Esin Durmus, Spandana Gella, Karolina Stanczak, and Siva Reddy. 2025. SafeArena: Evaluating the Safety of Autonomous Web Agents. InProceedings of the 42nd International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 267). PMLR, 60404–60441. https...

    2025

  32. [32]

    Jingyi Yang, Shuai Shao, Dongrui Liu, and Jing Shao. 2025. RiOS- World: Benchmarking the Risk of Multimodal Computer-Use Agents. In Advances in Neural Information Processing Systems, Vol. 38. Curran As- sociates, Inc. https://proceedings.neurips.cc/paper_files/paper/2025/hash/ 0c79d6ed1788653643a1ac67b6ea32a7-Abstract-Conference.html

    2025

  33. [33]

    Jianwei Yang, Hao Zhang, Feng Li, Xueyan Zou, Chunyuan Li, and Jianfeng Gao

  34. [34]

    Tianbao Xie, Danyang Zhang, Jixuan Chen, Xiaochuan Li, Siheng Zhao, Ruisheng Cao, Toh Jing Hua, Zhoujun Cheng, Dongchan Shin, Fangyu Lei, Yitao Liu, Yiheng Xu, Shuyan Zhou, Silvio Savarese, Caiming Xiong, Victor Zhong, and Tao Yu

  35. [35]

    InAdvances in Neural Information Processing Systems, Vol

    OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environments. InAdvances in Neural Information Processing Systems, Vol. 37. Curran Associates, Inc., 52040–52094. doi:10.52202/079017-1650

    doi:10.52202/079017-1650

  36. [36]

    Yanzhe Zhang, Tao Yu, and Diyi Yang. 2025. Attacking Vision-Language Com- puter Agents via Pop-ups. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Computational Linguistics, 8387–8401. doi:10.18653/v1/2025.acl-long.411

    doi:10.18653/v1/2025.acl-long.411 2025

  37. [37]

    Boyuan Zheng, Boyu Gou, Jihyung Kil, Huan Sun, and Yu Su. 2024. GPT-4V(ision) Is a Generalist Web Agent, If Grounded. InProceedings of the 41st International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 235). PMLR, 61349–61385. https://proceedings.mlr.press/v235/zheng24e.html

    2024

  38. [38]

    Xing, Hao Zhang, Joseph E

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhang- hao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. 2023. Judg- ing LLM-as-a-Judge with MT-Bench and Chatbot Arena. InAdvances in Neural Information Processing Systems, Vol. 36. Curran Associates, Inc., 46595–46623. https://pro...

    2023

  39. [39]

    Xiao Yang, Jiawei Chen, Jun Luo, Zhengwei Fang, Yinpeng Dong, Hang Su, and Jun Zhu. 2025. MLA-Trust: Benchmarking Trustworthiness of Multimodal LLM Agents in GUI Environments.arXiv preprint arXiv:2506.01616(2025). doi:10. 48550/arXiv.2506.01616

    Pith/arXiv arXiv doi:10.48550/arxiv.2506.01616 2025

  40. [40]

    Chi Zhang, Zhao Yang, Jiaxuan Liu, Yanda Li, Yucheng Han, Xin Chen, Zebiao Huang, Bin Fu, and Gang Yu. 2025. AppAgent: Multimodal Agents as Smartphone Users. InProceedings of the 2025 CHI Conference on Human Factors in Computing Systems. Association for Computing Machinery, Article 70, 20 pages. doi:10.1145/ 3706598.3713600

    arXiv 2025

  41. [41]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and Transferable Adversarial Attacks on Aligned Language Models.arXiv preprint arXiv:2307.15043(2023). doi:10.48550/arXiv. 2307.15043

    Pith/arXiv arXiv doi:10.48550/arxiv.2307.15043 2023

  42. [44]

    Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig

    Shuyan Zhou, Frank F. Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig. 2024. WebArena: A Realistic Web Environment for Building Autonomous Agents. InThe Twelfth International Conference on Learning Representations. https://openreview.net/forum?id=oKn9c6ytLx

    2024

  43. [45]

    Yaoming Zhu, Sidi Lu, Lei Zheng, Jiaxian Guo, Weinan Zhang, Jun Wang, and Yong Yu. 2018. Texygen: A Benchmarking Platform for Text Generation Models. InProceedings of the 41st International ACM SIGIR Conference on Research and Development in Information Retrieval. Association for Computing Machinery, 1097–1100. doi:10.1145/3209978.3210080

    arXiv 2018

  44. [2023]

    doi:10.48550/arXiv.2310.11441

    Set-of-Mark Prompting Unleashes Extraordinary Visual Grounding in GPT-4V.arXiv preprint arXiv:2310.11441(2023). doi:10.48550/arXiv.2310.11441

    Pith/arXiv arXiv doi:10.48550/arxiv.2310.11441 2023

  45. [2024]

    Do Anything Now

    “Do Anything Now”: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models. InProceedings of the 2024 ACM SIGSAC Con- ference on Computer and Communications Security. Association for Computing Machinery, 1671–1685. doi:10.1145/3658644.3670388

    arXiv 2024

  46. [2026]

    doi:10.1609/aaai.v40i44.41090

    MobileSafetyBench: Evaluating Safety of Autonomous Agents in Mobile Device Control.Proceedings of the AAAI Conference on Artificial Intelligence40, 44 (2026), 37565–37573. doi:10.1609/aaai.v40i44.41090

    doi:10.1609/aaai.v40i44.41090 2026