When Agents See Differently: Exposing UI Desynchronization Threats in Mobile Agents
Researchers expose 'human-agent UI desynchronization' attacks where repackaged APKs invisibly mislead mobile AI agents into attacker-chosen actions.
The paper introduces human-agent UI desynchronization: agents ingest digital screenshots and accessibility metadata that reveal content human users cannot perceive due to occlusion and luminance-contrast limits. An automated framework embeds perturbations into repackaged APK clones that steer mobile agents toward attacker-designated actions without access to runtime user instructions or online adaptation. Evaluations across five mobile-agent frameworks and three backbone models on 546 tasks achieved average misleading rates of 77.9% and 66.9%. A questionnaire study with 186 participants found the visual perturbations difficult for humans to notice.
- Same UI state presents materially different information to human users versus agents via screenshots and accessibility metadata.
- Automated framework constructs instruction-agnostic desynchronization attacks realized in deployable, repackaged APKs.
- Achieved 77.9% average misleading rate across five agent frameworks and 66.9% across three backbone models.
- 186-participant study shows attack perturbations are hard for human users to detect.
From the original article
1 min read at arxiv.orgMobile agents are increasingly capable of autonomously interacting with mobile applications and performing consequential actions on behalf of users. Effective human oversight of such agents relies on a basic premise: users and agents observe consistent information from the same interface. We show that this premise can be systematically violated.
By Heng Li · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.