PaperlayerView exact revision on arXiv

Source-linked AI summary

SeerGuard: A Safety Framework for Mobile GUI Agents via World Model Prediction

Xue Yu, Bo Yuan, Pengshuai Yang, Kailin Zhao, Hong Hu, Junlan Feng

arXiv:2607.15550v1cs.AI

TL;DR

Mobile GUI agents need to detect unsafe consequences before executing actions, because erroneous interactions can cause irreversible state changes. SeerGuard screens instructions and assesses action risks using a semantic safety-augmented world model, consistently improving the safety-utility trade-off across diverse agents.

  • Problem

    Mobile GUI safety mechanisms are largely reactive, leaving agents unable to assess whether candidate actions will cause unsafe future states before execution.

  • Method

    SeerGuard combines instruction-level screening with pre-execution action-risk assessment powered by a semantic safety-augmented world model.

  • Results

    SeerGuard consistently improves the safety-utility trade-off across diverse mobile GUI agents, with analyses validating instruction screening and action-risk assessment.

  • Takeaways & Limitations

    Consequence-aware protection proactively prevents risky mobile GUI operations before execution and generalizes across diverse GUI agents.

  • Takeaways & Limitations

    Future work must reduce missed risk detections on fine-grained tasks and false positives on benign tasks.

Abstract

from arXiv · show

Mobile graphical user interface (GUI) agents have demonstrated remarkable capabilities in automating complex tasks, yet they introduce critical safety risks where a single erroneous action can lead to irreversible consequences. Existing safety mechanisms are primarily reactive, lacking the ability to assess risks before execution. In this paper, we introduce SeerGuard, a consequence-aware safety framework designed to mitigate these risks through pre-execution instruction-level screening and action-level risk assessment. Specifically, the action-level assessment analyzes agent-proposed actions within current GUI states, anticipating likely outcomes to identify risks before they are executed. To enable these capabilities, we construct a unified safety-augmented world model (SAWM) via multi-task learning, integrating semantic next-state prediction with safety risk assessment. Extensive experiments demonstrate that SeerGuard generalizes effectively across diverse mobile GUI agents. On Qwen3-VL-8B-Instruct, it increases the safety-utility score from $0.191$ to $0.596$ at $ω=0.8$ and reduces the risk-cost score from $0.347$ to $0.130$ at $α=0.8$. Further analyses on our SAWM validate the effectiveness of the instruction-level screening, alongside the capability of action risk assessment and next-state prediction.

1. Introduction

Mobile GUI agents can cause irreversible harm through a single erroneous action, while existing reactive or instruction-only safeguards cannot reliably assess risks that depend on the current interface state. SeerGuard addresses this gap with pre-execution instruction screening and consequence-aware action assessment using a safety-augmented world model.

  • Motivation: A single erroneous mobile GUI action can trigger immediate, irreversible consequences such as unintended purchases, privacy leakage, data deletion, or system misconfiguration.
  • Limitations of Existing Safety Mechanisms: Existing defenses either detect explicit malicious intent without considering GUI state or assess risk after execution, when unsafe transitions may be irreversible.
  • SeerGuard: SeerGuard combines instruction-level screening that rejects malicious requests with action-level risk assessment that predicts likely consequences before execution.
  • Safety-Augmented World Model: Its Safety-Augmented World Model predicts semantic next states from multimodal GUI contexts, evaluates safety, and supports pre-execution consequence auditing without pixel-level prediction.
  • Evaluation: Safety-Utility Score and Risk-Cost Score jointly measure protection against harmful execution while accounting for retained benign-task utility and unnecessary refusal costs.
  • Evaluation: Experiments show that SeerGuard improves the safety–utility trade-off across diverse mobile GUI agents, with analyses validating instruction screening and action risk assessment.

2. Related Work

Prior work advances mobile GUI agents and world-model-based prediction, but existing safety methods remain limited by latency, rigid rules, or narrow scopes. SeerGuard addresses this gap through instruction-level screening and action-level risk assessment using online consequence prediction.

  • Mobile GUI Agents: Mobile GUI agents have progressed from hand-crafted rule-based systems to foundation-model-based agents capable of perceiving dynamic interfaces and completing long-horizon tasks across apps.MLLM advances enabled systems including UI-TARS and AutoGLM, while MagicGUI and DigiRL improve execution robustness and task success.
  • Safety Methods: Existing safety approaches face practical limitations, including substantial latency from step-wise verification, inflexible strict logic rules, and narrower emphasis on grounding or click accuracy.OS-Sentinel uses VLM-based contextual review, VeriSafe Agent relies on strict logic rules, and SafeGround emphasizes visual grounding and click accuracy rather than action safety.
  • World Models: World models let agents predict future states and reason about action consequences without direct interaction, supporting sequential decision-making in embodied AI and autonomous driving.Predictive modeling improves downstream planning and policy optimization in these domains.
  • Research Gap: Prior safety methods focus on harmful instruction detection, whereas world models use prediction to improve task success.This separation motivates combining safety screening with predictive environment modeling.
  • SeerGuard: SeerGuard bridges this gap by combining instruction-level screening with action-level risk assessment through online consequence prediction before unsafe actions execute.The framework enables proactive intervention prior to execution.

3. Framework of SeerGuard

SeerGuard is a dual-stage, consequence-aware framework that screens instructions before execution and audits candidate actions by predicting their semantic consequences. Its cascaded design blocks explicit malicious intent early while deferring context-dependent risks to runtime assessment.

  • Framework formulation: SeerGuard formulates mobile GUI interaction as sequential decision-making, with an agent observing GUI state o_t and proposing actions a_t over a trajectory horizon T.The interaction trajectory is τ = {o_0, a_0, o_1, a_1, . . . , o_T}.
  • Instruction-level screening: The instruction-level filter G_inst(I) labels requests safe or unsafe and provides a concise rationale before the agent enters the mobile environment.It flags explicitly harmful requests such as factory resets or forwarding verification codes, while passing seemingly benign requests onward.
  • Instruction-level screening: G_inst prioritizes high recall for explicit malicious intent while minimizing false positives, deferring ambiguous context-dependent risks to action-level monitoring.This cascade balances safety and utility by blocking obvious threats without over-rejecting harmless-looking tasks.
  • Action-level risk assessment: The world-model safety module G_WM evaluates candidate actions before execution by predicting their semantic consequences from real-time multimodal GUI observations.It replaces computationally expensive pixel-level reconstruction with textual semantic-transition decoding focused on functional consequences.
  • Action-level risk assessment: At each time step, G_WM outputs a predicted consequence, binary safety label, and rationale, enabling state-aware audits of post-action states before irreversible actions occur.The structured output is (ŝ_t+1, l_act, r_act) = G_WM(o_t, a_t), with l_act ∈ {safe, unsafe}.

4. Safety-Augmented World Model

Section 4 presents a unified safety-augmented world model that combines semantic next-state prediction with safety risk assessment for SeerGuard. It addresses scarce risky-operation data through a cross-modal data strategy and supports instruction screening followed by proactive action-risk assessment.

  • World Model Construction: The safety-augmented world model integrates semantic next-state prediction with safety risk assessment.It builds on MobileWorldBench capabilities for state-transition forecasting and action-consequence prediction.
  • Data Strategy: Risk-identification capability is difficult to develop because large-scale risky mobile-operation data are scarce.Direct collection is constrained by technical, ethical, and legal considerations.
  • Data Strategy: A cross-modal data strategy is used to augment safety awareness despite the scarcity of risky-operation data.The strategy is presented as a practical alternative to directly collecting large-scale risky mobile-operation data.
  • SeerGuard Pipeline: The SeerGuard pipeline first performs pre-execution instruction screening and then conducts proactive action risk assessment.The pipeline takes a user instruction, initial observation, GUI agent policy, and maximum horizon as inputs, and outputs Success or Refused.
  • SeerGuard Pipeline: During execution, the GUI agent generates a candidate action, SAWM predicts its consequence, and the environment returns the next screenshot.The pipeline repeats this process while t < T and checks whether the task is completed.

21 end

SeerGuard trains a safety-augmented world model using three complementary safety-data streams alongside MobileWorld next-state data. The unified training objective combines safety-risk identification with next-state forecasting while preserving generalization through constrained fine-tuning.

  • Safety-data construction: General textual safety data provides baseline human values and ethical alignment through instruction, binary-label, and rationale tuples.Each sample is structured as (I, l, r), where l denotes safe or unsafe and r explains the judgment.
  • Safety-data construction: Multimodal mobile risk data grounds safety concepts in GUI states by relabeling MobileWorld trajectories and adding manually collected malicious operations.The manually annotated set includes unauthorized payments, malicious comment posting, and prompt injection attacks.
  • Safety-data construction: The world model outputs an anticipated next state, binary safety label, and detailed reasoning for each proposed GUI action.Its output is formulated as GWM(o_t, a_t) = (ŝ_t+1, l, r).
  • Safety-data construction: Textual mobile risk data bridges general safety and multimodal GUI interaction by synthesizing safe and unsafe examples across 100 popular applications and five action types.The action types are click, long press, input, swipe, and press enter.
  • Model training: 148K instances combine MobileWorld next-state question-answering data with the three-tiered safety augmentation data for supervised fine-tuning of Qwen3-VL-8B-Instruct.The model is trained for exactly 1 epoch at a learning rate of 1 × 10^-6 to jointly forecast state transitions and identify risks.

5. Experiments

Experiments evaluate SeerGuard’s safety, utility, instruction screening, action-risk assessment, and world-model prediction across diverse mobile GUI tasks and agents. Results show broad risk reduction, strong safety-aware prediction, category-dependent gains, and competitive runtime despite added safeguards.

  • Experimental Setup: MobileSafetyBench contains 250 mobile GUI tasks spanning 150 high-risk and 100 low-risk scenarios across messaging, navigation, social media, calendars, and finance.Each task includes a user instruction, initial screen state, and safe-or-unsafe behavior annotation.
  • Experimental Setup: SeerGuard is compared with Direct and SCoT while evaluating three GUI-agent backbones: Qwen3-VL-8B-Instruct, GPT-5.1, and Gemini-3.1-Pro-Preview.Direct is an unguarded vanilla agent, while SCoT uses safety-guided chain-of-thought prompting.
  • Main Results: At α = 0.8, SeerGuard reduces RCS from 0.301 to 0.145 for GPT-5.1, from 0.368 to 0.180 for Gemini-3.1, and from 0.347 to 0.130 for Qwen3-VL.The reductions are reported consistently across all three backbones.
  • Instruction-Level Screening: SAWM achieves Recall 0.396 and F1 0.567 on Agent-SafetyBench, while PolyGuard attains the best F1 at 0.578 and SAWM outperforms Qwen3-VL at 0.545 and WildGuard at 0.542.Agent-SafetyBench contains only unsafe samples, testing defensive robustness under a full-risk setting.
  • Action-Level Risk Assessment: SAWM attains the highest trajectory-level F1 of 0.723 and Step Score of 0.361, balancing Precision and Recall better than methods prone to over-refusal.OS-Sentinel has Recall 0.814 but Precision 0.606, while MobileWorld reaches F1 0.594.
  • World Model Prediction: SAWM reaches Next-State-QA Accuracy 0.762, outperforming Intern-VL3-78B at 0.610 and Qwen3-VL-235B-A22B at 0.651.The result also exceeds MobileWorld, a model fine-tuned for environment dynamics from the same 8B backbone.
  • Latency vs. Safety: On MobileSafetyBench, Qwen3-8B averages 3.49 min per task, whereas Qwen3-VL+SeerGuard averages 3.35 min because many high-risk tasks terminate early.Early termination occurs through instruction screening or action-level risk assessment.

6. Conclusion

SeerGuard is a consequence-aware safety framework for mobile GUI agents that combines instruction-level screening with action-level risk assessment. Using a safety-augmented world model to predict semantic action outcomes, it proactively prevents risky operations and generalizes across diverse GUI agents.

  • Conclusion: SeerGuard combines instruction-level screening with action-level risk assessment for mobile GUI agent safety.The framework is explicitly consequence-aware.
  • Conclusion: SAWM predicts semantic action outcomes, enabling SeerGuard to proactively prevent risky operations before execution.SAWM is the framework’s safety-augmented world model.
  • Conclusion: Extensive experiments show that SeerGuard improves safety while generalizing across diverse GUI agents.The conclusion reports effectiveness across diverse GUI agents without specifying additional quantitative results in this passage.

A. Dataset · A.1. Composition of the Training Data

The training data combines general textual safety supervision with multimodal and text-only mobile GUI risk data. It further strengthens next-state understanding through trajectory-based annotations and a visual question-answering dataset.

  • A.1. Composition of the Training Data: General textual safety samples are re-annotated as instruction, safety label, and detailed reasoning tuples, with inconsistent samples discarded.Re-annotation uses gpt-oss-120b to provide a baseline of human values and ethical alignment.
  • A.1. Composition of the Training Data: Mobile risk trajectories are re-annotated with natural-language next-state predictions, binary safety labels, and detailed safety reasoning.The annotations build on MobileWorld’s Next-State-Generation dataset and use Qwen3-VL-30B-A3B.
  • A.1. Composition of the Training Data: A manually collected risky-operation set covers unauthorized payments, malicious comment posting, and prompt injection attacks.These examples use the same structured next-state, label, and reasoning format as the re-annotated trajectories.
  • A.1. Composition of the Training Data: The Next-State-QA dataset frames future-state prediction as visual question answering with yes-or-no questions conditioned on the current state and action.Its original annotations are adopted without additional modification.
  • A.1. Composition of the Training Data: Text-only mobile risk data bridges general textual safety and multimodal GUI interactions by generating safe and unsafe actions for 100 popular mobile applications.GPT-4o generates 10 safe and 10 unsafe actions per application.
  • A.1. Composition of the Training Data: Application information and action semantics are combined with generated task instructions to construct the final training data.The task instructions are generated with gpt-oss-120b before the components are reorganized.

A.2. Data Composition Analysis · B. Experimental Details · B.1. Unified Action Space

The paper evaluates how MobileRisk training-data composition affects SAWM and defines a shared action space for consistent modeling across diverse agent trajectories. Results favor balanced supervision, including specialized textual mobile-risk data, over skewed or omitted data sources.

  • A.2. Data Composition Analysis: The controlled MobileRisk experiments fix the corpus at 148K samples, including a constant 48K Next-State-QA subset, while varying other data components.The components are Dgen, Dgui, Dtext, and Dqa.
  • A.2. Data Composition Analysis: SAWM uses a default configuration with specialized textual mobile-risk data and a balanced safe-to-unsafe ratio of 2:1.This configuration is compared with Uniform, w/o Dtext, w/o Dgen, Dgen-Skewed, and Dgui-Skewed variants.
  • A.2. Data Composition Analysis: The evaluated variants alter source proportions by equalizing data, removing Dtext or Dgen, or skewing toward Dgen or Dgui.Uniform uses Dgen : Dgui : Dqa = 1:1:1, while Dgui-Skewed has a 6.8:1 safe-to-unsafe ratio.
  • A.2. Data Composition Analysis: 40.2 vs. 39.0: incorporating Dtext consistently improves performance over w/o Dtext, with SAWM achieving the best overall results.The analysis characterizes Dtext as a semantic bridge between general safety concepts and mobile-risk supervision.
  • A.2. Data Composition Analysis: Increasing one source at another’s expense degrades performance, showing that mobile safety alignment depends on balancing general safety knowledge with multimodal domain supervision.Both Dgen-Skewed and Dgui-Skewed reduce performance, and the findings emphasize balancing semantic roles and class distributions.
  • B.1. Unified Action Space: All agent task interactions are mapped into a shared action space to support consistent modeling across diverse task trajectories.The unified action space is illustrated in Table 8.

B.2. Training Setup · B.3. Instruction-level Screening Evaluation · B.4. Action-level Risk Assessment

SeerGuard’s SAWM is supervised-fine-tuned on Qwen3-VL-8B-Instruct, with separate prompts supporting instruction-level malicious-instruction screening and action-level next-state and risk assessment. The evaluations define safety judgments through explicit criteria and require structured JSON outputs grounded in the current mobile UI state and predicted action consequences.

  • B.2. Training Setup: SAWM is built on Qwen3-VL-8B-Instruct and trained through supervised fine-tuning.The training configuration is reported in the paper’s training setup materials.
  • B.2. Training Setup: The training setup includes a dedicated table reporting SAWM’s training configurations.The supplied passage identifies Table 9 as the source for these configurations but does not provide their values.
  • B.3. Instruction-level Screening Evaluation: Instruction-level screening uses a prompt designed to detect and filter malicious instructions before execution.The supplied passage identifies this as Prompt 1.
  • B.3. Instruction-level Screening Evaluation: The screening process assigns exactly one label: SAFE for judgment-oriented or non-concerning requests, and UNSAFE for prohibited requested content or actions.The criteria include privacy and trust violations, financial fraud and asset theft, and malicious, illegal, or harmful content.
  • B.4. Action-level Risk Assessment: Action-level assessment evaluates an autonomous agent’s proposed action using the task, current UI screenshot, and proposed action as inputs.The evaluator is framed as both a Mobile UI Action Safety Evaluator and a World Model.
  • B.4. Action-level Risk Assessment: The action-level prompt predicts the state transition and immediate feedback, then evaluates risks including financial security, privacy, data integrity, and irreversible actions.Prompt 2 requires a strict, parseable JSON response containing UI context analysis, action consequence prediction, risk evaluation, and a safety judgment.

C. Case Studies

SAWM case studies show scenario-general, agent-agnostic protection through complementary instruction-level screening and action-level risk assessment. It blocks privacy-sensitive requests, malicious navigation, and unsafe SMS workflows before harmful consequences occur.

  • Case-study scope: SAWM is evaluated through instruction-level screening and action-level risk assessment across high-risk MobileSafetyBench scenarios.The cases examine filtering unsafe requests before execution and assessing whether proposed actions may cause harm under the current GUI state.
  • Instruction-level screening: At the instruction level, SAWM detects privacy-sensitive unsafe intent and refuses the task before execution, unlike Qwen3-VL (Direct).SAWM recognizes requests involving access to, exposure of, or misuse of private information, whereas Qwen3-VL may focus on superficial wording.
  • Action-level risk assessment: At the action level, SAWM forecasts the likely next GUI state to judge whether a proposed action would produce unsafe outcomes.This approach evaluates risky interaction trajectories rather than only whether an individual action appears locally reasonable.
  • Action-level risk assessment: In Web Navigation, SAWM blocks a suspicious redirection toward an illegal or malicious website, outperforming Gemini-3.1 (Direct) in preventing potentially harmful navigation.The anticipated consequences include unauthorized transactions, phishing, or other security violations.
  • Action-level risk assessment: In SMS, SAWM stops a plausible editing trajectory that would produce unsafe biased content before the harmful message is completed or sent, unlike GPT-5.1 (Direct).The trajectory includes entering the messaging interface, focusing the text box, and preparing to send the drafted message.
Loading 2607.15550v1…