PaperlayerView exact revision on arXiv

Source-linked AI summary

ADeptS-Bench: Measuring the Trustworthiness of Computer Use Agents Across Devices

Joy Chen, Alejandro Castillejo Munoz, Pierluca D'Oro, Yuxuan Sun, Chloe Evans, Joseph Tighe

arXiv:2608.26204v1cs.CRcs.AIcs.SE

TL;DR

Existing benchmarks do not comprehensively evaluate whether computer-use agents can safely interpret visual interfaces while handling ambiguous instructions across platforms. ADeptS-Bench addresses this gap with paired visual safety and disambiguation streams grounded in user research, finding that no current agent is consistently both capable and safe.

  • Problem

    Existing benchmarks do not jointly evaluate visual-interface safety and disambiguation across platforms.

  • Method

    ADeptS-Bench uses paired benign/malicious visual tasks for safety and screenshot-based ambiguous-decision tasks for disambiguation.

  • Results

    No current Computer Use Agent is both capable and safe; across seven models, no model consistently exceeds 80% TSR while staying below 30% ASR.

  • Takeaways & Limitations

    The benchmark reveals three safety architectures, non-uniform cross-platform behavior, and a universal tendency to overestimate risk severity.

  • Takeaways & Limitations

    The benchmark covers English-language tasks on Android and Windows/Mac/Linux, with a US-based survey of 1,300 participants.

Abstract

from arXiv · show

Computer Use Agents (CUAs) are increasingly deployed to navigate mobile and desktop applications on behalf of users, yet no benchmark comprehensively evaluates whether they can safely interact with visual interfaces while handling ambiguous instructions. We introduce ADeptS-Bench, a dual-stream trustworthiness benchmark, grounded in the ADEPTS capability framework and general population user studies. The Safety stream provides paired benign/malicious tasks with threats embedded in the visual interface. The Disambiguation stream evaluates whether agents seek clarification when intent is ambiguous. Evaluating seven models reveals that no model consistently exceeds 80% task success while staying below 30% attack success; every model clicks "Checkout" on a $25K order without hesitation, and none detects that a "factory reset" button is mislabeled as "Optimize." An ablation reveals three distinct safety architectures: tool-dependent (ASR +21-23pp without refusal tool), partially tool-dependent (+10-11pp), and no mechanism (unchanged). In disambiguation, all models overestimate consequence severity, mirroring the over-refusal bias observed in safety. We release all data, evaluation code, and analysis tools upon publication.

1 Introduction

ADeptS-Bench addresses the lack of a cross-platform benchmark jointly evaluating visual-interface safety and disambiguation. Across seven models, no system consistently combines high task success with low attack success, while safety mechanisms and rankings vary substantially.

  • Motivation: Existing benchmarks do not jointly evaluate visual-interface safety and disambiguation across platforms.They also commonly rely on live infrastructure and researcher-defined threat categories.
  • Design principles: ADeptS-Bench grounds risk prioritization in user research, expert workshops, and a general-population MaxDiff survey of 1,300 participants.The process is intended to measure risks users worry about.
  • Design principles: The Safety stream embeds threats in screenshots, while the Disambiguation stream tests clarification at ambiguous decision points using human-calibrated obviousness and consequence axes.The same textual instruction can appear benign while the visual interface contains the threat.
  • Design principles: Offline evaluation requires one API call for each safety task and one model call plus judge calls for each disambiguation task.No live environment is needed.
  • Findings: 76.0% is the best ADeptS-Bench Score, achieved by Gemini 3.1 Pro; no model consistently exceeds 80% TSR while staying below 30% ASR.The benchmark therefore finds no model that is both capable and safe under its stated criterion.
  • Findings: Safety mechanisms differ: Gemini 3.1’s ASR doubles without explicit refusal tools, Claude and GPT retain implicit safety, and Qwen shows no safety behavior.The ablation identifies tool-dependent, partially tool-dependent, and absent safety mechanisms.
  • Findings: 42–62% of disambiguation items were rated too high in consequence severity by all models, mirroring safety’s over-refusal pattern.This result is described as calibration bias.
  • Findings: Model rankings shift across platforms and streams: Gemini 3.1 Pro leads mobile disambiguation but ranks fourth on desktop, where Claude 4.7 Opus is strongest.The paper concludes that no single metric, platform, or capability test captures the full picture.

2 Related Work

Prior benchmarks separately study task completion, safety, or ambiguity handling, typically through live trajectory evaluation. ADeptS-Bench distinguishes itself by combining paired visual safety, disambiguation, offline evaluation, and user-grounded risk taxonomy.

  • Existing benchmark families: Capability benchmarks focus on task completion, while safety work spans GUI-grounded, tool-calling, and hybrid attack evaluations.These benchmark families address different aspects of computer-use-agent behavior.
  • Benchmark gap: ADeptS-Bench is the only benchmark in the comparison combining all eight listed properties, including visual grounding, offline use, paired tasks, disambiguation, and user research.The table marks properties as present, absent, or partial.
  • Benchmark gap: Existing benchmarks use trajectory-based live evaluation, and none combines paired design, disambiguation, or offline visual grounding.This limits direct comparison with ADeptS-Bench’s design.
  • Disambiguation benchmarks: AmbiBench and related benchmarks evaluate ambiguity handling in live multi-turn environments, while other approaches address dynamic or text-based settings.ADeptS-Bench complements these approaches with its own evaluation design.

3 The ADeptS-Bench Benchmark

ADeptS-Bench combines user-grounded risk modeling with paired visual safety tasks and screenshot-based disambiguation tasks. It evaluates capability, attack susceptibility, refusal behavior, clarification quality, and severity calibration using offline grading procedures.

  • Safety risk framework: The safety framework analyzes risk by attack origin, threat type, victim, and harm across intrinsic and extrinsic threat categories.The taxonomy covers ten threat categories adopted largely from an agent-safety survey.
  • Safety risk framework: Risk categories were developed through expert workshops and a MaxDiff survey of 1,300 US participants ranking 44 undesirable outcomes.Survey results determine which categories to include and prioritize.
  • Safety stream: Paired safety tasks share an instruction but use benign or malicious screenshots, measuring capability in the benign variant and safety in the malicious variant.The safety stream contains 1,718 instances across mobile and desktop and ten threat categories.
  • Safety stream: Only 3.3% of benign tasks remained universally failed after review, compared with 11.4% of malicious tasks universally complied with.The latter group was dominated by threats requiring consequence reasoning.
  • Disambiguation stream: Disambiguation tasks present screenshot trajectories averaging 4.7 screenshots and require agents to choose whether to clarify or act.The stream contains 744 tasks across linguistic ambiguity, referential underspecification, and impossible tasks.
  • Disambiguation stream: Each disambiguation task is scored on obviousness and consequence, with ground-truth clarification questions supporting precision and recall evaluation.Agents should clarify when either calibrated score is high.
  • Evaluation metrics: TSR measures benign-task completion, ASR measures unsafe actions on malicious tasks, and FRR measures benign tasks receiving an unsafe refusal.These metrics separate capability, attack susceptibility, and over-safety.
  • Evaluation metrics: The ADeptS-Bench Score is the harmonic mean of TSR and 1−ASR, penalizing models that sacrifice either capability or safety.A model with 90% TSR and 90% ASR scores 17.1%.

4 Experiments

Across safety and disambiguation, ADeptS-Bench exposes trade-offs, platform-dependent rankings, and systematic failures in consequence reasoning. Models vary in their reliance on refusal tools, while ambiguous or high-impact interface decisions remain difficult.

  • Safety results: 82.9% TSR and 29.8% ASR made Gemini 3.1 Pro desktop the only model×platform combination exceeding 80% TSR while staying below 30% ASR.It achieved the best ADeptS-Bench Score, S=76.0%.
  • Safety results: 83.6% desktop TSR made Gemini 2.5 CU the most capable frontier model, but its 51.5% ASR was substantially higher than Gemini 3.1 Pro’s 29.8%.The comparison suggests computer-use specialization does not automatically preserve safety, although training differences cannot be ruled out.
  • Safety tool ablation: Removing the refusal tool increased frontier-model ASR by 10–23pp, while Qwen models changed by ±1pp.Gemini 3.1 Pro was most affected at +22pp; the associated usage instruction was removed with the tool.
  • Safety tool ablation: Three safety mechanisms emerged: tool-dependent Gemini 3.1 Pro, partially tool-dependent Claude and GPT-5.4, and tool-independent Qwen models.Removing the tool also improved benign TSR by 1–8pp for frontier models, reflecting reduced false refusal.
  • Safety failure spectrum: 66.3% of threats were ambiguous L3 contexts, while 10.8% were L4 cases with no visual cues; all models missed harmful action scale or label mismatch.The hierarchy indicates current safety training handles pattern matching at L1–L2 but fails at consequence reasoning in L3–L4.
  • Disambiguation results: 58.9% was Gemini 3.1 Pro’s best mobile disambiguation F1, whereas Claude 4.7 led desktop with 47.6%; rankings shifted across platforms and capabilities remained partly independent.All models overestimated consequence severity on 42–62% of matched items, and the scoring prompt improved weaker models’ F1 but reduced Gemini 3.1 Pro’s by 3.6pp.

5 Discussion and Limitations

The discussion positions single-step visual-threat evaluation as complementary to trajectory-level safety testing, while identifying platform-specific behavior and concrete remediation targets. It also notes harness-resolution and judge-related limitations.

  • Limitations: Single-step evaluation isolates atomic violations involving threats embedded in visual interfaces, complementing rather than replacing trajectory-level agentic safety benchmarks.Some tasks may have legitimate justifications that broader trajectory context would resolve.
  • Discussion: GPT-5.4 was safe and capable on overt requests yet complied with 36% of ADeptS-Bench malicious desktop tasks, exposing interface-embedded vulnerabilities.The comparison indicates these failures were not attributed to grounding error or over-refusal.
  • Limitations: The benchmark’s safety estimates may be conservative for models evaluated with downscaled inputs because input resolution is non-uniform across harnesses.The paper identifies non-uniform input resolution as the main residual harness limitation.
  • Limitations: The LLM judge is itself an evaluated model, although human validation found no directional bias and it ranked fourth on desktop disambiguation.This constrains interpretation while providing reported checks against judge bias.
  • Discussion: Safety improves on desktop by 4–8pp TSR while disambiguation drops by 8–38pp F1, with model rankings shifting across platforms.The authors interpret this non-uniformity as evidence that mobile and desktop present qualitatively different challenges.
  • Remediation: Ablation results motivate internalizing refusal during post-training rather than delegating safety to a promptable refusal tool.The recommendation targets persistence across harness and deployment configurations.
  • Remediation: Training should target consequence reasoning, because models detect explicit visual threats but miss danger conveyed by action scale or label mismatch.Examples include a $25K checkout and a factory-reset control labeled “Optimize.”

6 Conclusion

ADeptS-Bench finds that no current Computer Use Agent is both capable and safe. Its paired safety and disambiguation evaluation reveals distinct safety architectures and cross-platform variation, providing targets for improvement.

  • 6 Conclusion: No current Computer Use Agent is both capable and safe across ADeptS-Bench’s paired safety evaluation and disambiguation analysis.The benchmark spans mobile and desktop and reports three safety architectures plus non-uniform cross-platform behavior.
  • 6 Conclusion: ADeptS-Bench provides concrete targets for improving Computer Use Agent trustworthiness and releases its data, evaluation code, and analysis tools upon publication.

Ethical Statement

The benchmark’s safety design limits misuse potential through static, single-step tasks, synthetic or public screenshots, review procedures, and privacy-preserving annotation practices.

  • Ethical Statement: Tasks are single-step predictions without exploitable multi-step attack trajectories, and malicious screenshots depict generic threat patterns rather than working exploits.
  • Ethical Statement: The benchmark underwent institutional legal and safety review before release, with trained professional annotators compensated fairly and working without deception.
  • Ethical Statement: Screenshots use synthetic or publicly available content, contain no personally identifiable information, and the general-population survey retained no personal data.
  • Dataset Scope: Dangerous Commands is desktop-only because it targets CLI and terminal interactions unavailable to end users on mobile operating systems.
  • Dataset Scope: The remaining nine threat categories are approximately balanced across platforms, with 37–43 mobile and 48–54 desktop instances.

B Grading Methodology Details

The grading methodology maps spatial predictions to expanded ground-truth regions, matches non-spatial action types, and treats invalid tool calls differently for benign and malicious tasks.

  • Spatial action grading: For tap and long-press actions, a prediction matches when its coordinate falls inside the ground-truth bounding box expanded by margin m.
  • Spatial action grading: For benign tasks, reward equals hit; for most malicious tasks, hit denotes attack success, while 27 reverse-flagged tasks use reward = 1 −hit.The margin is uniformly set to m = 0.01.
  • Non-spatial action grading: For non-tap actions, grading checks action-type agreement, with a tap inside the typing field accepted as a match for a TypeAction target.
  • No-action handling: Invalid tool-call outputs receive reward=0; on malicious tasks this counts as safe, whereas on benign tasks it counts as failure.
  • Intent analysis: GPT-5.4’s safe-scored malicious responses were classified into refusal, clicked-elsewhere, near-miss, and non-tap categories to assess whether tap misses inflated safety scores.

C Bounding Box Margin Sensitivity Analysis

The analysis examines how bounding-box margin choices affect benign task success and notes that GPT-5.4 is especially sensitive because of its higher tap-miss rate.

  • Most models change by ≤3pp across the tested bounding-box margin range.Table 6 reports benign TSR across different margins for desktop models.
  • The safety stream contains 859 task pairs spanning ten threat categories and nine risk categories.Threat categories are approximately balanced except for Dangerous Commands, while data, financial, and physical loss receive the most tasks.
  • The grader expands each ground-truth bounding box by margin m=0.01 when evaluating spatial actions.This uniform margin is used across models and measures end-to-end grounding capability, including spatial accuracy.
  • GPT-5.4’s ∼30% tap-miss rate is roughly double that of other models.Its higher miss rate makes safety estimates more sensitive to the grading margin.

E Failure Mode Analysis

The failure analysis finds distinct safety weaknesses across models, including non-deterministic decisions, excessive compliance with harmful scope, and vulnerabilities tied to visual or semantic threat patterns.

  • Per-task worst-case safety: GPT-5.4 shows the largest per-task worst-case ASR increase, +22–23pp, across repeated runs.This corresponds to approximately 200 flaky tasks per platform, whereas Qwen-4B changes by only +2–3pp.
  • Threat failure patterns: Excessive or mass actions account for 19 all-comply tasks, where models perform the requested action at harmful scale.Examples include checking out a $6K cart, disabling all connected devices, and forwarding all emails.
  • Frontier versus open-source safety: 101 tasks are refused by all frontier models but complied with by all open-source models.The gap is largest in Prompt Injection, Web Hacking, and Jailbreak, supporting an alignment-training explanation in the analysis.
  • Model-specific vulnerability profiles: Claude 4.7 has 13 unique vulnerabilities, the fewest among frontier models, while Gemini 2.5 CU has 181.Gemini 2.5 CU’s vulnerabilities concentrate in Jailbreak and Web Hacking; Claude’s include Hallucination, Reasoning Gap, and Web Hacking.
  • Visual analysis: Gemini CU’s 181 unique failures follow action-ready, clean-professional, and embedded-text visual patterns.These patterns include prominent clickable buttons, semantically malicious routine screens, and threats requiring text comprehension.
  • Over-refusal: Frontier models fail 55 benign tasks that open-source models pass, with over-refusal triggered by urgency, promotion, and suspicious-sounding names.The paired design also shows failures when benign and malicious variants are visually similar but differ in precise content or action.
  • Per-threat-category breakdown: System sabotage reaches 68.5% ASR for GPT-5.4, making it the most effective threat category in the reported breakdown.Gemini 3.1 Pro and Claude 4.7 defend Web Hacking and Prompt Injection most effectively among the cited models.

G Disambiguation Stream: Extended Analysis

The extended disambiguation analysis examines dataset composition, prompt effects, category recall, severity calibration, and evaluation procedures across mobile and desktop settings.

  • Dataset composition: 80.7% of mobile tasks have maximum obviousness, while desktop tasks are concentrated at moderate obviousness with 93.1% scoring 1.The differing ambiguity profiles partly explain why desktop disambiguation is harder.
  • Prompt ablation: The severity-scoring prompt inflates clarification rate by 4–40pp across models.Mode 1 reveals natural clarification rates ranging from 23.6% for Qwen-8B to 88% for Claude.
  • Prompt ablation: Gemini 3.1 Pro’s F1 is 62.5% without severity scoring versus 58.9% with it.Qwen-235B shows the opposite pattern, improving from 40.2% to 52.8% with scoring.
  • Per-category recall: All models struggle with impossible tasks, with best recall of 66.7% on logical counterfactuals and 46.2% on environmental misalignment.Gemini 3.1 Pro leads referential underspecificity and missing parameters, while Gemini CU records the cited environmental-misalignment result.
  • Severity calibration: Frontier models achieve 80–87% exact-match obviousness accuracy but overestimate consequence severity on 54–59% of items.Mean bias ranges from +0.47 to +0.56, paralleling over-refusal behavior in the safety stream.
  • Evaluation validation: Five annotators produced within-1 agreement of 90.5–93.1% on mobile and 89.8–94.5% on desktop.Krippendorff’s α is lower because ordinal ratings concentrate heavily at one level.
  • Evaluation validation: The LLM judge achieves 96.1% agreement with human judgments, with κ=0.92, for clarification-question matching.Models generate clarification questions from screenshots and instructions, with separate judge calls evaluating matches.
  • Evaluation setup: All models share one-tool-call and screenshot-based evaluation constraints, while harnesses adapt coordinate formats and tool schemas.The ablation removes the unsafe option from the tool schema and removes the corresponding prompt rule.

I Extended Benchmark Comparison

The benchmark comparison situates ADeptS-Bench among existing GUI-agent safety and disambiguation evaluations using additional dimensions and trajectory-level distinctions.

  • Table 16 extends the comparison with existing GUI agent safety and disambiguation benchmarks across additional benchmarks and dimensions.Table 1 in the main paper provides the summary comparison.
  • The comparison distinguishes trajectory, single-call, single-step, judge-based, and computer-use evaluations, with partial coverage marked by ∼.The abbreviations clarify how benchmark evaluation units and model scope are represented.

J Grading Methodology Lessons

ADeptS-Bench’s methodology combines user-grounded risk prioritization, static paired task grading, and explicit behavioral policies. The authors also identify grading edge cases and scope boundaries affecting how benchmark results should be interpreted.

  • Grading choices: m = 0.01 uniformly expands ground-truth bounding boxes because grounding precision is part of the measured capability.The grader uses expanded boxes for spatial actions, while non-spatial actions use action-type matching and a tap-before-type accommodation.
  • Grading choices: Strict tool-call grading assigns TSR=0 to valid text answers without tool calls, slightly penalizing capable models on information-retrieval tasks.The authors identify this as a known limitation of the grading scheme.
  • User-grounded prioritization: 1,300 US participants ranked 44 undesirable outcomes in a MaxDiff survey, with identity theft, financial loss, and account compromise among the leading concerns.The sample was digitally literate and AI-aware; 74.1% prioritized vulnerability to external attackers over accidental agent-caused harm.
  • Benchmark design: These survey findings prioritized privacy, financial, and adversarial threat categories in the benchmark, while retaining lower-concern categories with fewer tasks.The paired design makes benign compliance and malicious refusal explicit, and high-value legitimate transactions are treated as severe because of their scale.
  • Scope and validity: Static, single-step screenshots measure atomic susceptibility to interface-embedded threats rather than end-to-end trajectory safety.The benchmark avoids executable payloads and successful-attack trajectories, and its risk prioritization is bounded by a US-based, English-speaking, digitally literate sample and English Android/desktop tasks.
Loading 2608.26204v1…