测试手机界面智能体在真实威胁下的表现，发现第三方内容会大幅降低其准确率。
Mobile GUI Agents under Real-world Threats: Are We There Yet?
- 构建可扩展的内容注入框架，模拟真实应用中的第三方内容干扰。
- 在动态和静态环境下测试，平均误导率分别达42.0%和36.1%。
- 适合关注移动端AI代理安全性的研究者与开发者。
近年来，基于大语言模型（LLM）的移动GUI智能体快速发展，能根据自然语言指令自主执行设备控制任务。尽管其在标准基准上准确性不断提升，已有多款商业产品上线，但它们在真实世界威胁下的鲁棒性仍存疑。现有基准多基于静态、可控的应用内容，而真实应用包含大量来自不可信第三方的内容，如广告邮件、用户生成帖子和媒体等。为此，我们提出一种可扩展的应用内容注入框架，实现对现有应用的灵活、精准内容修改。基于该框架，我们构建了一个测试套件，包含122个可复现的动态任务和超过3,000个由商用应用构造的静态挑战场景。对开源及商用GUI智能体进行实验发现，所有被测智能体均显著受第三方内容影响，动态环境平均误导率达42.0%，静态环境为36.1%。相关框架与基准已公开于https://agenthazard.github.io。
原文摘要 · Abstract (English)
Recent years have witnessed a rapid development of mobile GUI agents powered by large language models (LLMs), which can autonomously execute diverse device-control tasks based on natural language instructions. The increasing accuracy of these agents on standard benchmarks has raised expectations for large-scale real-world deployment, and there are already several commercial agents released and used by early adopters. However, are we really ready for GUI agents integrated into our daily devices as system building blocks? We argue that an important pre-deployment validation is missing to examine whether the agents can maintain their performance under real-world threats. Specifically, unlike existing common benchmarks that are based on simple static app contents (they have to do so to ensure environment consistency between different tests), real-world apps are filled with contents from untrustworthy third parties, such as advertisement emails, user-generated posts and medias, etc. ... To this end, we introduce a scalable app content instrumentation framework to enable flexible and targeted content modifications within existing applications. Leveraging this framework, we create a test suite comprising both a dynamic task execution environment and a static dataset of challenging GUI states. The dynamic environment encompasses 122 reproducible tasks, and the static dataset consists of over 3,000 scenarios constructed from commercial apps. We perform experiments on both open-source and commercial GUI agents. Our findings reveal that all examined agents can be significantly degraded due to third-party contents, with an average misleading rate of 42.0% and 36.1% in dynamic and static environments respectively. The framework and benchmark has been released at https://agenthazard.github.io.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。