PaperlayerView exact revision on arXiv

Source-linked AI summary

When Agents See Differently: Exposing UI Desynchronization Threats in Mobile Agents

Heng Li, Fulin Zhao, Zhe Geng, Zhiyuan Yao, Wei Yuan, Xiapu Luo

arXiv:2609.16732v1cs.CR

TL;DR

Mobile agents and users can receive materially different information from the same interface, creating a security gap in human oversight. The paper develops an automated framework for pre-deployed, instruction-agnostic UI perturbations and finds substantial misleading rates across diverse mobile-agent settings, while identifying realization and environmental-complexity limits.

  • Problem

    The paper asks whether human-agent UI desynchronization can let a repackaged legitimate application steer mobile agents while remaining apparently unchanged to users.

  • Method

    The authors search screenshot and accessibility feature spaces for UI perturbations, then realize optimized perturbations as deployable APK modifications targeting agent decisions.

  • Results

    Across 546 tasks, the framework achieves average misleading rates of 77.9% in static evaluation and 66.9% in dynamic evaluation across five agent frameworks and three backbone models.

  • Takeaways & Limitations

    Human-agent UI desynchronization is a security risk because pre-deployed perturbations can influence mobile agents while remaining inconspicuous to users.

  • Takeaways & Limitations

    Feature-space perturbations cannot always be faithfully realized in APKs, contributing to lower dynamic than static misleading rates.

Abstract

from arXiv · show

Mobile agents are increasingly capable of autonomously interacting with mobile applications and performing consequential actions on behalf of users. Effective human oversight of such agents relies on a basic premise: users and agents observe consistent information from the same interface. We show that this premise can be systematically violated. Users perceive mobile interfaces through physical displays and the human visual system, making their observations subject to occlusion and luminance contrast limitations. In contrast, agents consume digital screenshots that may retain such content and accessibility representations that expose nonvisual widget metadata. The same UI state can therefore present materially different information to users and agents, a mismatch we term human-agent UI desynchronization. We investigate whether a repackaged clone of a legitimate APK can exploit this desynchronization to steer an agent toward attacker-designated actions, while remaining fully functional and behaviorally consistent with the original application for human users. We demonstrate that this threat is feasible: perturbations embedded before deployment can induce such deviations without access to runtime user instructions, agent detection or online adaptation. To systematically expose and evaluate this threat, we develop an automated framework that constructs user runtime instruction-agnostic UI desynchronization attacks and realizes them in deployable APKs. We conduct static and dynamic evaluations across five mobile-agent frameworks and three backbone models on 546 tasks involving various applications, achieving average misleading rates of 77.9% and 66.9%, respectively. A complementary questionnaire-based study with 186 participants finds that the visual perturbations used in our attacks are difficult for human users to notice.

1 Introduction

Mobile-agent oversight assumes users and agents receive consistent interface information, but physical perception and digital observation channels can diverge. The paper shows that pre-deployed UI perturbations can exploit this desynchronization to redirect agents while preserving ordinary human-facing behavior.

  • Motivation: Human-agent UI desynchronization arises because users face occlusion and contrast limits while agents retain screenshot content and nonvisual accessibility metadata.Thus, the same UI state can expose materially different information to users and agents.
  • Threat: The threat question is whether a repackaged legitimate-app clone can steer an agent toward attacker-designated actions while appearing unchanged to the user.This differs from an application directly executing harmful logic because the clone manipulates an external agent’s observations.
  • Threat: The attacks require neither runtime user instructions nor agent detection, and honeypot selection operationalizes deviation from the user-intended path.The honeypot represents an attacker-designated action without introducing an actual malicious payload.
  • Approach: The framework searches perturbations in screenshot and accessibility feature spaces, then realizes optimized changes as deployable APK modifications.It uses a predefined strategy space, operation pruning, beam search, IDRR feedback, and semantic code localization.
  • Empirical evaluation: 77.9% static and 66.9% dynamic average misleading rates were achieved across 546 tasks, 13 applications, five agent frameworks, and three backbone models.The evaluation also tests transfer to unseen tasks, while 186 participants assess human detectability.

2 Preliminaries and Desynchronization Model

Mobile agents interpret interfaces through perception, planning, and action selection using visual screenshots, accessibility structures, or both. Human-agent desynchronization occurs when these channels expose action-relevant information differently, enabling machine-visible semantics or actions that users cannot comparably see or use.

  • Mobile-agent pipeline: Agents process interfaces through three stages: state perception, plan generation, and concrete action selection.This abstraction organizes the later perturbation strategies around where agent decisions can be misled.
  • Desynchronization model: Human-agent UI desynchronization is an action-relevant cross-observer inconsistency when application-controlled information affects agent behavior without comparable user cues.Representational differences alone are not security threats unless they influence interpretation, planning, or action selection.
  • Visual mismatches: Screenshot channels can preserve content hidden by physical display occlusions or encoded with low luminance contrast that users struggle to perceive.These geometric and photometric mismatches arise because agents process digital pixels while users perceive displayed light.
  • Structured mismatches: Accessibility representations can expose content descriptions, roles, interaction attributes, bounds, and hierarchy that are absent from the rendered UI.Widgets may also remain technically clickable to agents while being too small, transparent, or occluded for ordinary touch interaction.
  • Security relevance: Together, these mismatches leave application-controlled semantics and actions available to agents without comparable visibility or usability for ordinary users.The paper therefore studies how benign-looking repackaged applications can deliberately construct such action-relevant mismatches.

3 Threat Model

The threat model considers a repackaged Android application that preserves human-visible behavior while embedding fixed, instruction-agnostic UI perturbations to steer mobile agents. Success is measured by whether agents select a honeypot and leave the user-intended path.

  • Adversary model: The adversary distributes a modified APK that preserves the original application’s human-visible appearance and functionality while embedding agent-targeted UI perturbations.The attack relies on differences between user perception and agent-consumed UI representations rather than human-versus-agent detection.
  • Attack goal and metric: An agent is considered misled when it selects the embedded honeypot and consequently deviates from the user-intended execution path.Honeypot selection measures steering capability, not the execution of a particular malicious payload.
  • Attack space: The strategy space targets state perception, path planning, and action selection, matching the three-stage mobile-agent decision pipeline.The threat-model overview connects these attack categories with feature-space search over candidate perturbations.
  • Deployment assumptions: Once distributed, perturbations are fixed and do not require runtime instruction detection or remote command-and-control.The attack is constrained to changes prepared and embedded before APK release.
  • Adversary constraints: The attack must be pre-deployed, runtime-instruction-agnostic, and generalizable across diverse user goals, phrasings, and interaction flows.The adversary cannot predict exact real-user instructions and cannot assume users request only supported task templates.

4 Design

The design framework constructs deployable UI desynchronization attacks by organizing perturbations around agent decision stages, optimizing them in feature space, and realizing them in target APKs. Its offline, instruction-agnostic pipeline uses composable operations and cost-aware selection to steer agents toward honeypots.

  • UI Perturbation Strategy Space: Nine task-independent strategies target state perception, path planning, or action selection through composable UI operations.The strategy space replaces unconstrained perturbation generation with structured atomic modifications to UI content.
  • Feature- and Problem-Space Pipeline: The framework searches structured or visual agent observations before translating optimized perturbations into deployable APK modifications.Feature-space search avoids rebuilding and executing the application for every candidate; problem-space realization locates corresponding implementation sites.
  • Attack Strategy Categories: State-oriented attacks make the normal workflow appear unavailable, prompting agents toward honeypots presented as restoring, verifying, or unlocking the required state.Path-oriented attacks offer an apparently preferable alternative route, while preference-oriented attacks increase a honeypot’s salience, safety, authority, or recommendation strength.
  • Application-Specific Realization: Strategy realizations are generated from natural-language operation prompts and adapted to each target APK while retaining shared strategy definitions and operation sequences.For example, a banking realization can combine an initialization warning, an Initialize honeypot, and Unavailable accessibility prefixes for transfer controls.
  • Strategy Selection: Strategy selection balances honeypot-selection effectiveness against perturbation cost, including serialized representation growth and newly added or modified UI elements.The score uses feature-space hits over an offline task subset, while cost weights textual and structural modifications.
  • Content Optimization: IDRR ranks how soon an agent selects the honeypot by repeatedly removing selected alternatives, providing a finer optimization signal than binary success.The procedure is capped at five iterations; unselected honeypots receive infinite rank, and the reward decays exponentially with rank.

5 Evaluation

The attacks remain effective across agents, task variations, strategies, reasoning settings, and attacker-side models, while human users rarely notice the visual perturbations. Evaluation also reveals important trade-offs: dynamic deployment reduces misleading rates relative to static optimization, whereas stronger reasoning can increase attack effectiveness.

  • Overall Effectiveness: 77.9% static MR and 66.9% dynamic MR were achieved across 56 agent–model–task settings, with dynamic MR remaining 62.4%–71.2% across task variations.The attack retained comparable effectiveness on original, style-rewritten, in-app supplementary, and out-of-app tasks.
  • Overall Effectiveness: Dynamic MR was 10.96% lower than static MR on average, especially for structured-UI agents because accessibility-tree perturbations were harder to reproduce faithfully in APKs.In some settings, dynamic execution instead increased MR when a simpler interface made the honeypot more prominent.
  • Attack Strategy Analysis: 69.3% MR for State-Path combinations exceeded the individual category rates of 42.3% and 21.4%, while strategy pairs such as S1+S5 reached 84.8%.Cross-category combinations consistently outperformed their corresponding individual attack categories.
  • Victim Reasoning: 79.1% known-task MR-D under high reasoning versus 43.3% under minimal reasoning shows that stronger victim-model reasoning did not improve robustness.Unknown-task MR-D similarly rose from 46.3% to 81.4% as reasoning increased; the authors suggest longer reasoning may reinforce injected misleading information.
  • Ablation Study: Content Optimization improved MR by 4.1–17.9 percentage points across all five agents, increasing T3A from 54.2% to 72.1%.The authors attribute the larger T3A gain partly to its substantially longer structured GUI descriptions, which make initial realizations less precise.
  • Human Detectability: 88.7% of participants reported no abnormality in the first screenshot, and no participant reported seeing the injected perturbation text.The remaining 11.3% mainly cited general interface issues rather than the low-contrast text.

6 Discussion

The discussion identifies limitations in realizing and sustaining UI perturbations across deployment settings, while outlining model- and input-level defenses.

  • 6.1 Limitations: Feature-space perturbations cannot always be faithfully realized in APKs, causing the observed drop from static to dynamic misleading rates.A multi-round interactive realization process could improve alignment but would substantially increase token consumption and time cost.
  • 6.1 Limitations: Denser application interfaces can dilute perturbation salience and reduce misleading effectiveness as environmental complexity increases.The authors suggest denser-state optimization or multiple coordinated honeypots as possible remedies.
  • 6.2 Potential Defense Strategies: Attack-aware prompts and future safety-alignment datasets or fine-tuning may reduce susceptibility because mobile agents depend on the robustness of their underlying LLMs.The authors also note that current LLMs are not specifically aligned for Android UI automation security.
  • 6.2 Potential Defense Strategies: Attack effectiveness may decrease when image preprocessing blurs low-resolution or low-contrast perturbations, although aggressive preprocessing can also reduce normal task performance.The discussion specifically mentions downsampling, compression, and low-pass filtering as potential defenses.

7 Related Work

Related work has advanced natural-language mobile-agent execution while revealing that environmental UI content can manipulate agents. Existing attacks generally expose similar deceptive content to users and agents or rely on runtime adaptation, leaving desynchronization-based pre-deployment attacks underexplored.

  • Mobile Agents: Mobile-agent research progressed from short-horizon LLM-driven GUI automation toward stronger grounding, training, reasoning, verification, and deployment-oriented systems.Representative systems include AutoDroid, AutoDroid-V2, AppAgent, AndroidWorld, and UI-TARS.
  • Threats to Mobile Agents: Security studies show that deceptive pop-ups, advertisements, user-generated content, notifications, and other environmental inputs can manipulate mobile GUI agents.Related benchmarks also examine environmental injection and chain-level jailbreaks.
  • Threats to Mobile Agents: Most prior attacks expose similar and obvious deceptive content to users and agents or adapt using runtime instructions or agent-detection signals.This leaves systematic exploitation through embedded UI modifications unclear.

8 Conclusion

The paper establishes human-agent UI desynchronization as a security risk and demonstrates deployable pre-deployment perturbations that mislead mobile agents while remaining inconspicuous to users.

  • 8 Conclusion: 77.9% and 66.9% average misleading rates were achieved in static and dynamic evaluations across 546 tasks, 13 applications, five agent frameworks, and three backbone models.The results motivate aligning user-visible interfaces with agent-observable representations.

Ethics Discussion

The ethics discussion emphasizes controlled, anonymized evaluation of a dual-use attack surface and frames the work as supporting defenses while reducing disclosure risks.

  • Ethics Discussion: The evaluation used benign honeypot widgets in controlled environments and excluded credential theft, payments, data exfiltration, and other harmful payloads.Questionnaire responses were anonymized and reported only as aggregate statistical distributions.
  • Ethics Discussion: The authors acknowledge that desynchronization techniques are dual-use but argue that characterizing the attack surface supports defense development while released artifacts use benign honeypot redirections.This framing addresses disclosure risks without claiming deployment against real users or services.

Open Science

The paper provides reproducibility materials and details an automated attack framework with predefined perturbation strategies and expanded task coverage. Its strategy space spans state, path, and action-selection manipulations, while evaluation tasks include stylistic, newly generated in-app, and out-of-app variants.

  • Open Science: The implementation, experimental configurations, and evaluation artifacts are released in an anonymized repository.
  • Attack Strategies: The strategies manipulate readiness, risk, identity, path competition, apparent optimality, procedural guidance, saliency, safety bias, and social signals.
  • Task Expansion: Task coverage is expanded through stylistic rewrites, automatically synthesized in-app tasks, and tasks outside each application’s functional scope.

D Mobile Agents used in experiments

The experiments cover five mobile-agent frameworks spanning text-based, vision-based, and multimodal perception. These agents differ in their use of accessibility trees, screenshots, annotations, and programmatic exploration.

  • Mobile Agents: The evaluation includes five frameworks: DroidBot-GPT, AutoDroid, T3A, AppAgent, and M3A.
  • Text-Based Agents: DroidBot-GPT, AutoDroid, and T3A are text-based agents that primarily use structured Android accessibility representations.
  • Multimodal Agent: M3A jointly reasons over accessibility information, annotated screenshots, and original screenshots using a vision-language model.
  • Vision-Based Agent: AppAgent is vision-centric and relies solely on numerically labeled screenshots without direct accessibility-tree access.

E Efficiency Evaluation

The attack pipeline is practical because its offline computation is moderate on average, although runtime varies substantially across agent–backbone configurations. Most cost comes from feature-space search rather than APK realization.

  • Runtime Results: 570 seconds per APK on average, with total runtime ranging from 224 to 2820 seconds across 15 agent–LLM configurations.Because optimization occurs offline before deployment, this cost is practical from the attacker’s perspective.
  • Runtime Breakdown: 94% of the pipeline runtime comes from Strategy Selection and Content Optimization, while problem-space realization takes about 45 seconds on average.The main computational cost is feature-space LLM-based search, whereas APK-level realization is lightweight.
  • Runtime Differences: 2820 seconds is the slowest configuration, arising for T3A with Qwen because its longer GUI representation produces larger prompts and higher processing costs.
  • Runtime Differences: Gemma is generally faster than GPT, and GPT is generally faster than Qwen under the same agent.The paper attributes this pattern mainly to differences in API latency and provider throughput.

F Understanding Differences between Static and Dynamic Evaluation

Static and dynamic misleading rates differ because deployment can alter UI structure, agent decisions, runtime states, and the number of available interactions. Additional analyses show that perturbation effectiveness persists across display cutouts but declines in denser interfaces.

  • Why Dynamic Rates Decrease: 47.3% of lower dynamic cases for text-based agents result from changed widget position, order, or implementation after perturbations are realized in executable APKs.
  • Why Dynamic Rates Decrease: For vision-based agents, 63.8% of lower dynamic cases involve failure to recognize perturbations, while execution failures account for 16.8%.Recognition can vary with contrast, size, visibility, or surrounding content.
  • Runtime States: Unexpected network errors, login failures, and loading screens can prevent agents from reaching the statically evaluated interface.
  • Why Dynamic Rates Increase: 64.4% of increases in dynamic misleading rate arise from simpler runtime interfaces, while 35.6% arise from honeypot selection at later interaction steps.Dynamic evaluation permits up to five actions, whereas static evaluation checks only the first action.
  • Environmental Robustness: 64.72%–85.15% overall static misleading rates remain across evaluated cutout sizes, geometries, and placements, with unknown-task rates reaching 91.54%.The centered placement performs best overall, but left and right placements remain effective for both AppAgent and M3A.
  • Environmental Complexity: MR-S decreases as more UI elements are introduced because dense interfaces dilute perturbations among legitimate content.
Loading 2609.16732v1…