Source-linked AI summary
Do Phone-Use Agents Respect Your Privacy?
Zhengyang Tang, Ke Ji, Xidong Wang, Zihan Ye, Xinyuan Wang, Yiduo Guo, Ziniu Li, Chenxin Li, Jingyuan Hu, Shunian Chen, Tongxu Luo, Jiaxi Bi, Zeyu Qin, Shaobo Wang, Xin Lai, Pengyuan Lyu, Junyi Li, Can Xu, Chengquan Zhang, Han Hu, Ming Yan, Benyou Wang
TL;DR
Phone-use agents increasingly perform real mobile tasks, but existing evaluations do not operationalize privacy or expose data handling during execution. The paper introduces MyPhoneBench, combining the iMy privacy contract with instrumented mock apps and rule-based auditing. Across five models, 10 apps, and 300 tasks, it finds that success, privacy-compliant completion, and later-session preference use are distinct capabilities, with no model dominating all three.
Problem
Existing evaluations emphasize task completion but do not define privacy-compliant phone use or reveal which data agents enter into forms during execution.
Method
MyPhoneBench combines the iMy contract for permissioned access, minimal disclosure, and user-controlled memory with instrumented apps and deterministic auditing.
Results
Across five models, 10 apps, and 300 tasks, task success, privacy-compliant completion, and later-session preference use are distinct capabilities, and no single model dominates all three.
Takeaways & Limitations
Success-only evaluation overestimates phone-use agents’ deployment readiness because agents can complete benign tasks while violating privacy boundaries.
Takeaways & Limitations
The benchmark targets behavioral privacy during execution and does not cover broader cross-app leakage, messaging disclosure, or network-level exfiltration.
Abstract
from arXiv · showhide
We study whether phone-use agents respect privacy while completing benign mobile tasks. This question has remained hard to answer because privacy-compliant behavior is not operationalized for phone-use agents, and ordinary apps do not reveal exactly what data agents type into which form entries during execution. To make this question measurable, we introduce MyPhoneBench, a verifiable evaluation framework for privacy behavior in mobile agents. We operationalize privacy-respecting phone use as permissioned access, minimal disclosure, and user-controlled memory through a minimal privacy contract, iMy, and pair it with instrumented mock apps plus rule-based auditing that make unnecessary permission requests, deceptive re-disclosure, and unnecessary form filling observable and reproducible. Across five frontier models on 10 mobile apps and 300 tasks, we find that task success, privacy-compliant task completion, and later-session use of saved preferences are distinct capabilities, and no single model dominates all three. Evaluating success and privacy jointly reshuffles the model ordering relative to either metric alone. The most persistent failure mode across models is simple data minimization: agents still fill optional personal entries that the task does not require. These results show that privacy failures arise from over-helpful execution of benign tasks, and that success-only evaluation overestimates the deployment readiness of current phone-use agents. All code, mock apps, and agent trajectories are publicly available at~ https://github.com/FreedomIntelligence/MyPhoneBench.
1 Introduction
The paper asks whether increasingly capable phone-use agents handle user data responsibly during benign tasks, where success-only evaluation misses privacy violations. It introduces an explicit privacy contract and auditable framework to make these behaviors measurable.
- Phone-use agents can complete benign tasks while requesting unnecessary access, disclosing contact information, or carrying personal data across sessions.The task may succeed even when privacy boundaries are crossed.
- Success-only benchmarks do not reveal extra permission requests, optional personal entries, or re-submitted contact data to irrelevant widgets.Ordinary apps generally do not expose which values agents typed into which form entries during execution.
- Privacy compliance must specify default data access, approval-required data, and information that may be stored for later tasks.Explicit execution-time boundaries make privacy violations definable, comparable, and auditable.
- MyPhoneBench pairs an explicit privacy contract with controlled apps and deterministic checks over individual form entries.The framework preserves recurring privacy-risk structures from real apps rather than reproducing commercial interfaces pixel by pixel.
- Across five models, 10 apps, and 300 tasks, task success, privacy-compliant completion, and later-session preference use are distinct capabilities.No single model dominates all three axes.
- The framework turns behavioral privacy in phone-use agents into a measurable property rather than a vague concern.
2 Making Privacy Measurable in Phone-Use Agents
The evaluation makes phone-use privacy measurable by combining an executable contract, instrumented apps, and controlled probes with deterministic auditing. It evaluates task completion, privacy boundaries during execution, and later-session use of saved preferences.
- The benchmark evaluates whether agents finish tasks, avoid privacy-boundary violations during execution, and reuse permitted preferences in later sessions.
- The iMy privacy contract: The iMy contract defines executable boundaries for default data use, permission-required data, and information saved for later tasks.
- The iMy privacy contract: LOW data may be used by default, whereas HIGH data requires explicit user approval before use.The two-category split is designed to be understandable, followable, and checkable, not as a uniquely correct deployed privacy policy.
- The iMy privacy contract: The contract makes memory measurable by keeping saved preferences visible, editable, and deletable through the iMy interface.Later-session tasks can test whether a saved preference is correctly reused.
- Auditable environments: Instrumented apps record every edit to on-screen form boxes, including entries in forms that are never submitted.Database writes and access logs support deterministic checks of task completion and privacy outcomes.
- Task construction and coverage: The benchmark covers 300 tasks across 10 controlled apps and 9 domains, including 50 cross-session pairs for preference reuse.The task set is concentrated on form-centric workflows where privacy boundaries can be audited deterministically.
3. Does it fill optional personal entries when the task does not require them?
The evaluation isolates three privacy failures that can occur during otherwise helpful task execution: unnecessary permission requests, re-disclosure to non-essential widgets, and filling optional personal entries. Its metrics separately track task completion, privacy behavior, and later-session preference use.
- Over-permissioning: A bait chain places an optional HIGH field after a required LOW field, testing whether agents request data the task does not need.The layout makes requesting both fields the easiest completion-driven behavior unless the agent exercises restraint.
- Trap resistance: Privacy traps re-ask for known contact data through plausible marketing or convenience widgets that the task does not require.Examples include promotional sign-up boxes and a “Priority Scheduling” section requesting a phone number again.
- Form minimization: A sandwich places an optional personal entry between required fields, testing whether agents fill unnecessary information simply because they already know it.This probe measures form minimization without requiring a permission request.
- Privacy probes: The three probes test over-permissioning, trap resistance, and form minimization as distinct ways agents can violate privacy while remaining helpful.They respectively target unnecessary permission requests, re-submission to plausible but unnecessary destinations, and optional personal entries.
- Evaluation outcomes: The benchmark reports task success, average privacy, privacy-qualified success at τ = 0.7, and later-session use of saved preferences as separate outcomes.Privacy-qualified success requires both completing the task and reaching the privacy threshold, while later-session use is evaluated with paired tasks.
3 Experimental setup
The experiment runs five frontier models through MyPhoneBench on controlled Android tasks, restoring seeded states and auditing outcomes deterministically. Results show different leaders across task success, privacy-qualified completion, and later-session preference use, with joint evaluation changing model ordering.
- Experimental setup: Five frontier models are evaluated through MyPhoneBench on an Android emulator using per-model coordinate strategies for vision-language interaction.The evaluated models span five providers: Claude Opus 4.6, Gemini 3 Pro, Doubao Seed 1.8, Qwen 3.5 Plus, and Kimi K2.5.
- Experimental setup: Each run restores a seeded database state and evaluates database writes and audit logs after GUI interaction.The infrastructure uses a Pixel 6 emulator with API 33, a 100-step limit, and temperature 0.0.
- Main results: 82.8% task success is highest for Claude Opus 4.6, 77.3% average privacy is highest for Kimi K2.5, and 47.6% privacy-qualified success at τ = 0.7 is highest for Qwen 3.5 Plus.The different leaders demonstrate that the evaluation axes measure distinct capabilities.
- Main results: 47.6%, 47.2%, and 45.2% are the top three privacy-qualified success rates at τ = 0.7, where joint evaluation changes the model ordering.The threshold sweep confirms that this qualitative ordering change does not depend on a single cutoff.
- Main results: 72% later-session preference use leads Claude Opus 4.6, followed by Kimi K2.5 at 58%, Qwen 3.5 Plus at 48%, Doubao Seed 1.8 at 42%, and Gemini 3 Pro at 20%.This ordering differs from task success and single-session proxy diagnostics.
5 Analysis
The analysis shows that privacy weaknesses differ by probe, app, and model, while single-session diagnostics can overestimate reliable later-session preference transfer.
- 5.1 Different privacy probes reveal different weaknesses: Kimi is strongest across all three privacy probes, whereas Claude trades weaker privacy for higher task success.The probes are over-permissioning, trap resistance, and form minimization.
- 5.1 Different privacy probes reveal different weaknesses: mDoorDash has a 40% average trap-resistance score, while mDMV has 41% form minimization.These app-level stress tests reflect plausible re-disclosure widgets in food delivery and pressure to overfill identity forms in government services.
- 5.1 Different privacy probes reveal different weaknesses: Form minimization is the hardest privacy probe for all models.This failure reflects overfilling optional personal entries even when task success does not depend on them.
- 5.2 Later-session use of saved preferences measures transfer, not just tool use: Single-session preference proxies can overstate true later-session transfer.The paired metric requires Session B to reflect the preference carried over from Session A.
- 5.2 Later-session use of saved preferences measures transfer, not just tool use: Qwen scores 73%/68% on the first two diagnostics versus Kimi’s 67%/58%, but Kimi leads paired transfer 58% to 48%.The proxy overestimation gap reaches 23 percentage points for Qwen, with a similar pattern for Gemini.
6 Related work
Prior phone-use benchmarks evaluate task completion through state verification, trajectory procedures, or LLM judging, while privacy and safety benchmarks address other settings. MyPhoneBench targets behavioral privacy during benign GUI-grounded phone tasks.
- Phone-use agent benchmarks: Existing phone-use benchmarks evaluate completion through deterministic database or state verification, procedural trajectory evaluation, or LLM-based judging.WebArena and OSWorld instead address web and desktop agents.
- LLM safety and privacy: Prior privacy and safety benchmarks evaluate risks outside GUI-grounded phone-use execution or target adversarial UI injections.MyPhoneBench complements them by examining voluntary data handling during benign tasks.
- LLM safety and privacy: MyPhoneBench evaluates whether agents request unnecessary permissions, fill non-essential fields, or over-share data during phone tasks.Its focus is behavioral privacy in controlled GUI-grounded execution.
7 Limitations
The benchmark covers a controlled slice of behavioral privacy using mock apps and a deterministic user simulator. Its results should therefore be interpreted within that scope rather than as coverage of all deployed phone-use privacy risks.
- Scope: MyPhoneBench focuses on behavioral privacy during agentic task execution, covering data access, disclosure, and later-session saved-preference use.It does not cover every privacy risk relevant to deployed phone-use agents.
- Scope: The benchmark does not yet cover broader cross-app leakage, messaging disclosure, or network-level exfiltration.Its controlled scope enables deterministic auditing at the level of individual form entries.
- Evaluation setting: Mock apps and a deterministic user simulator isolate agent behavior rather than reproducing production mobile software heterogeneity.Per-app analyses are diagnostic stress tests rather than standalone leaderboards.
- Evaluation setting: Because user responses are intentionally permissive, the evaluation measures voluntary restraint rather than denial handling.This setting tests whether agents request or disclose unnecessary data, not how they respond to refusal.
- Conclusion: The conclusion reports that current agents do not reliably respect privacy during benign tasks, with overfilling optional personal entries as the most persistent failure.The authors characterize this behavior as more consistent with completion-oriented bias than access-control confusion alone.
A Full action space
The evaluated agents choose among GUI actions, privacy-contract actions, and task termination within one action loop. Privacy is scored through over-permissioning, trap resistance, form minimization, and an equal-weight privacy-qualified success measure, revealing different model leaders across metrics.
- A Full action space: Agents may perform one GUI action, invoke one iMy privacy-contract action, or end the task within the same action loop.Privacy decisions are evaluated alongside ordinary task completion.
- A Full action space: Over-permissioning penalizes unnecessary or forbidden access requests according to their necessity level.Required requests receive no penalty, while plausible, unnecessary, and forbidden requests receive progressively larger penalties.
- A Full action space: Trap resistance measures privacy-trap violations, while form minimization penalizes unnecessarily filled optional personal entries.Both dimensions are computed from form drafts.
- A Full action space: The task privacy score averages evaluable dimensions equally, including only dimensions reached during execution.The dimensions are over-permissioning, trap resistance, and form minimization.
- A Full action space: Privacy-qualified success counts tasks that are completed and meet a shared privacy threshold, rather than measuring privacy behavior alone.The default threshold is τ = 0.7.
- A Full action space: Different metrics produce different leaders, and joint evaluation changes the model ordering relative to either metric alone.Claude leads task success but ranks fourth on average privacy, whereas Kimi leads average privacy but ranks third on privacy-qualified success; the exact ordering depends on the threshold.
D Mock app inventory
The benchmark uses independently implemented mock apps inspired by real-world service categories, with supporting diagnostics spanning cross-session preference use and standardized model interaction conventions.
- D Mock app inventory: The 10 mock apps are independently built research artifacts for academic evaluation and are not affiliated with their commercial service inspirations.The suite preserves service-category coverage without reproducing or deriving from the corresponding commercial services.
- D Mock app inventory: The framework standardizes model-specific screenshot coordinate conventions before converting them into emulator actions.Claude emits fractional expressions, Kimi decimal ratios, and Qwen, Doubao, and Gemini normalized coordinates with model-specific ranges.
- D Mock app inventory: Later-session preference evaluation spans 50 cross-session pairs across 10 mock apps and separates proxy diagnostics from the paired main metric.‘Saved After A’ and ‘Used When Needed’ are single-session proxies, while ‘Later-session use’ is the paired later-session measure.