Are GUI Agents Focused Enough? Automated Distraction via Semantic-level UI Element Injection
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2026
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866908949215707136 |
|---|---|
| author | Yang, Wenkui Jin, Chao Zhu, Haisu Luo, Weilin Yuen, Derek Shao, Kun Huang, Huaibo Duan, Junxian Cao, Jie He, Ran |
| author_facet | Yang, Wenkui Jin, Chao Zhu, Haisu Luo, Weilin Yuen, Derek Shao, Kun Huang, Huaibo Duan, Junxian Cao, Jie He, Ran |
| contents | Existing red-teaming studies on GUI agents have important limitations. Adversarial perturbations typically require white-box access, which is unavailable for commercial systems, while prompt injection is increasingly mitigated by stronger safety alignment. To study robustness under a more practical threat model, we propose Semantic-level UI Element Injection, a red-teaming setting that overlays safety-aligned and harmless UI elements onto screenshots to misdirect the agent's visual grounding. Our method uses a modular Editor-Overlapper-Victim pipeline and an iterative search procedure that samples multiple candidate edits, keeps the best cumulative overlay, and adapts future prompt strategies based on previous failures. Across five victim models, our optimized attacks improve attack success rate by up to 4.4x over random injection on the strongest victims. Moreover, elements optimized on one source model transfer effectively to other target models, indicating model-agnostic vulnerabilities. After the first successful attack, the victim still clicks the attacker-controlled element in more than 15% of later independent trials, versus below 1% for random injection, showing that the injected element acts as a persistent attractor rather than simple visual clutter. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2604_07831 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Are GUI Agents Focused Enough? Automated Distraction via Semantic-level UI Element Injection Yang, Wenkui Jin, Chao Zhu, Haisu Luo, Weilin Yuen, Derek Shao, Kun Huang, Huaibo Duan, Junxian Cao, Jie He, Ran Cryptography and Security Computation and Language Computer Vision and Pattern Recognition Existing red-teaming studies on GUI agents have important limitations. Adversarial perturbations typically require white-box access, which is unavailable for commercial systems, while prompt injection is increasingly mitigated by stronger safety alignment. To study robustness under a more practical threat model, we propose Semantic-level UI Element Injection, a red-teaming setting that overlays safety-aligned and harmless UI elements onto screenshots to misdirect the agent's visual grounding. Our method uses a modular Editor-Overlapper-Victim pipeline and an iterative search procedure that samples multiple candidate edits, keeps the best cumulative overlay, and adapts future prompt strategies based on previous failures. Across five victim models, our optimized attacks improve attack success rate by up to 4.4x over random injection on the strongest victims. Moreover, elements optimized on one source model transfer effectively to other target models, indicating model-agnostic vulnerabilities. After the first successful attack, the victim still clicks the attacker-controlled element in more than 15% of later independent trials, versus below 1% for random injection, showing that the injected element acts as a persistent attractor rather than simple visual clutter. |
| title | Are GUI Agents Focused Enough? Automated Distraction via Semantic-level UI Element Injection |
| topic | Cryptography and Security Computation and Language Computer Vision and Pattern Recognition |
| url | https://arxiv.org/abs/2604.07831 |