PaperlayerView exact revision on arXiv

Source-linked AI summary

GUIAuditor: Enabling Post-hoc Child Safety Forensics via Action-Guided GUI Provenance on Mobile Devices

Junlin Liu, Yifeng Cai, Shuai Wang, Zhineng Zhong, Shaofei Li, Jiacheng Liu, Yuanchun Li, Ziqi Zhang, Xiangqun Chen, Ding Li, Yao Guo

arXiv:2609.28205v1cs.CR

TL;DR

Automated defenses can struggle to assess risks embedded in children’s in-app interaction sequences, while existing records may not provide semantic context for review. GUIAuditor turns GUI activity into queryable GUI Provenance and uses distilled evidence for guardian-led investigation. Its evaluations report strong event logging and retrieval results, with a stated limitation that the risk taxonomy is not exhaustive.

  • Problem

    Automated defenses may miss context embedded in interaction sequences, and existing post-hoc records do not provide a complete, semantically rich account for guardian review.

    Source: §1 · p. 2

  • Method

    GUIAuditor uses action-guided evidence distillation and MLLM analysis to create queryable GUI Provenance for guardian-led forensic investigation.

    Source: §1 · p. 3

  • Results

    95.23% Macro-F1 in risk-category labeling and over 90.20% top-result retrieval of the correct event for natural-language questions were reported.

    Source: §1 · pp. 3–4

  • Takeaways & Limitations

    On tested mobile devices, the design supports accurate forensic investigation with moderate overhead and provides guardians contextual evidence that automated systems often lack.

    Source: §8 · p. 25

    The risk taxonomy is not exhaustive, and real-world risks may span categories; scenarios and queries partly reflect the predefined taxonomy.

    Source: §6.4 · p. 24

Abstract

from arXiv · show

The proliferation of smart devices exposes children to online risks like grooming and financial scams that are deeply embedded within legitimate applications. Current approaches rely on automated prevention and detection, a paradigm that is fundamentally limited by its inherent fallibility. Whether rule-based or AI-driven, they inevitably produce false positives and negatives, failing to provide reliable protection. In this paper, we argue for a complementary, human-in-the-loop, post-hoc forensic paradigm. We present GUIAuditor, the first system designed to realize this vision by creating GUI Provenance: a queryable, semantic record of a child's interaction sequence. To generate this, GUIAuditor leverages a Multimodal Large Language Model (MLLM) to translate the temporal sequence of GUI events into a human-understandable narrative. To make this practical on mobile devices, a novel evidence distillation pipeline reduces the data requiring analysis by over 89.2% compared to periodic sampling approaches adopted by industry standards, with negligible impact on accuracy. On a new dataset of 295 interaction clips, GUIAuditor achieves a 95.23% Macro-F1 Score in logging significant events and, crucially, its two-stage forensic query engine successfully retrieves the correct evidence as the top result for over 90.20% of natural language questions. An end-to-end evaluation on three modern smartphones shows that the full pipeline, including on-device MLLM inference, adds 2.1W of power draw and 7.4s of per-event latency, with a peak memory footprint of ${\sim}$3.1GB. These results show that post-hoc GUI forensics can run on modern mobile devices and provide useful context for guardian-led safety review.

1 INTRODUCTION

Automated child-safety defenses can miss interaction context, while existing post-hoc records lack the semantic and visual context needed for review. GUIAuditor proposes queryable GUI Provenance for guardian-led investigation and reports strong event-logging and forensic-retrieval results.

1 INTRODUCTION

  • Rule-based and AI-driven automated defenses remain fallible, producing false positives and false negatives that prevent reliable protection on their own.Rule-based controls can miss in-app context, while AI models face incomplete knowledge, hallucinations, and adversarial bypass.Source: §1 · p. 2
  • Post-hoc forensic analysis complements automated defenses by preserving runtime evidence for guardians to investigate missed threats and verify or dismiss alerts.Existing app histories are fragmented and often lack visual context; periodic snapshot systems are designed for desktop hardware and do not summarize interaction sequences semantically.Source: §1 · pp. 2–3
  • GUIAuditor creates GUI Provenance, a structured, queryable record that uses an MLLM to turn temporal GUI activity into a human-understandable narrative.The record retains interaction context that can reveal intent beyond a static screen, such as a payment confirmation.Source: §1 · p. 3
  • The design combines action-guided evidence distillation, policy-driven semantic analysis, and hybrid storage with two-stage querying to address capture, interpretation, and access challenges.Interaction events select visual evidence for MLLM analysis, while the query engine supports broad event retrieval and detailed interrogation.Source: §1 · p. 3
  • 95.23% Macro-F1 in labeling risk categories; the query engine retrieves the correct event as the top result for over 90.20% of natural-language questions.Detailed follow-up questions are answered with 88.24% accuracy.Source: §1 · pp. 3–4

2 BACKGROUND

The background adapts child-safety risk categories to mobile apps, reviews why automated defenses lack interaction context, and introduces GUI Provenance as a way to preserve that context.

2 BACKGROUND

  • The section frames mobile in-app risks within a taxonomy adapted from the 4Cs model and grounded in governmental studies and prior work.The adaptation reflects mobile payment and data-centric privacy risks.Source: §2.1 · p. 4

2.1 A Taxonomy of In-App Risks for Children

  • The mobile risk taxonomy retains Content and Contact risks while treating Financial and Privacy risks as distinct categories for app-specific threats.Examples include deceptive in-app purchases and malicious permission requests.Source: §2.1 · pp. 4–5

2.2 Overview of Existing Defense Paradigms

  • A food order and a livestream gift can end at visually identical payment screens, so isolated-screen defenses lack the sequence context needed to distinguish intent.Super apps make this context gap acute because one application can host messaging, shopping, and gaming.Source: §2.2 · p. 5, Figure 1 · p. 6

2.3 From System Provenance to GUI Provenance

  • GUI Provenance is a structured, queryable record of the semantic flow of user interactions, documenting how the current screen was reached.A food checkout and livestream-gifting checkout can have the same endpoint but different preceding flows.Source: §2.3 · p. 6, Figure 1 · p. 6

3 THREAT MODEL AND RATIONALE

The threat model considers risks arising through legitimate apps on an unmodified device, with a guardian serving as the post-hoc decision-maker. GUIAuditor is scoped to interaction-mediated risks and specified on-device operation.

3.1 Operational Scenario and Attacker Model

  • The scenario assumes a standard device with a non-compromised OS and official apps, while attackers use legitimate app channels to create contact, financial, or content risks.The child is treated as a non-expert susceptible to social engineering or deceptive UI patterns.Source: §3.1 · p. 7

3.2 Defender Model

  • The parent or legal guardian is the defender, typically remote during device use and needing intuitive tools rather than expert security analysis.The guardian makes the final decision, using GUIAuditor to interpret device data in safety terms.Source: §3.2 · p. 7

3.3 System Scope and Assumptions

  • GUIAuditor is scoped to interaction-mediated risks: passive content that a child never opens or interacts with is outside capture, though later interaction is logged.The stated system scope also requires guardian and child consent and performs capture and MLLM analysis on-device without sending screen content to external servers.Source: §3.3 · p. 7

4 DESIGN OF GUIAUDITOR

GUIAuditor organizes its workflow into evidence distillation, semantic analysis, and storage and querying. Its distillation design exploits action-centered GUI behavior to reduce redundant frames and visually unchanged regions before MLLM analysis.

4 DESIGN OF GUIAUDITOR

  • GUIAuditor uses three collaborating modules: evidence distillation, MLLM-based analysis, and storage and querying for guardian-led investigation.The workflow turns a raw stream into compact visual evidence, a structured provenance record, and queryable events.Source: Figure 2 · p. 8, §4 · p. 8

4.1 Evidence Distillation Module (Mod①)

  • GUI streams combine event-driven semantics, redundant frames from delayed UI updates, and spatially sparse screens, motivating hierarchical evidence reduction.The three-step pipeline compacts the raw stream before costly MLLM analysis.Source: §4.1 · pp. 8–9

4.1.1 Step 1: Action-Guided Adaptive Sampling.

  • Action-guided adaptive sampling captures a dense temporal window only after a tap or swipe, using interaction events as proxies for intent and important moments.The implementation uses 2 fps over a 2-second window; overlapping windows merge during rapid successive actions.Source: §4.1.1 · p. 9

4.1.2 Step 2: Fast Deduplication via Pixel Similarity.

  • Pixel-similarity deduplication compares adjacent candidate frames and discards the latter when their L1 distance falls below a threshold.This removes exact or near-exact duplicates produced by UI delays and repetitive actions.Source: §4.1.2 · pp. 9–10

4.1.3 Step 3: Semantic Intra-frame Compression.

  • Semantic intra-frame compression compares aligned patch features across consecutive keyframes and removes semantically unchanged regions such as backgrounds and toolbars.The remaining visual tokens represent screen changes for MLLM analysis.Source: §4.1.3 · p. 10

4.2 Model Analysis Module (Mod②)

Mod② turns distilled visual evidence into structured, policy-guided event records; Mod③ stores those records and supports guardian investigations from broad event search to detailed follow-up questions.

4.2 Model Analysis Module (Mod②)

  • Mod② uses a policy-driven MLLM with structured reasoning to produce a JSON record containing a summary, risk classification, and evidence-grounded rationale.Records classified as No Risk are discarded; potential-risk records are passed to Mod③.Source: §4.2 · pp. 10–11

4.3.1 Unified Hybrid Data Store.

  • Mod③ stores each provenance record as one database row combining indexed metadata, generated text, and core visual tokens rather than raw video.The design aims to support scene reproduction while minimizing privacy-sensitive data stored on the device.Source: §4.3.1 · p. 11
  • The query engine uses SQL filtering or vector search to retrieve events, then re-invokes the MLLM on stored visual evidence to answer detailed follow-up questions.Summary text, rather than visual tokens, is embedded because the events are sequential and domain-specific GUI interactions.Source: §4.3.2 · p. 12, §4.3.1 · p. 12

5 EVALUATION

The evaluation asks whether GUIAuditor records risk episodes faithfully, supports accurate forensic queries, and incurs practical on-device performance overhead.

5 EVALUATION

  • RQ1 evaluates how faithfully GUIAuditor logs and labels risk episodes for later forensic questions.The evaluation distinguishes provenance fidelity from query accuracy and device-level overhead.Source: §5 · p. 12
  • RQ2 evaluates how accurately the forensic query engine retrieves relevant events and answers factual follow-up questions..Source: §5 · p. 12
  • RQ3 measures end-to-end on-device overhead, including power and inference latency, against a naive continuous-analysis approach..Source: §5 · p. 12

5.1 Experimental Setup

The evaluation uses a newly constructed interaction benchmark, separates effectiveness testing from device-cost measurements, and defines metrics for provenance fidelity, query accuracy, and overhead.

5.1.1 Data Construction.

  • The 295 retained clips average 17.2 seconds and have consensus labels from three researchers; the benchmark was deliberately balanced across five risk and benign categories.The study collected 320 clips before discarding cases without clear annotator consensus.Source: §5.1.1 · p. 14

5.1.2 Ethics Considerations.

  • Data collection used dual consent for minors, guardian presence, and adult-only assignment of tasks involving explicitly harmful visual content.Collected data were access-controlled and used solely to validate the safety auditing pipeline.Source: §5.1.2 · p. 14

5.1.3 Implementation Details and Baselines.

  • Effectiveness testing ran on a server, while end-to-end deployment cost was measured on three modern smartphones.The setup was intended to isolate fidelity and query accuracy from device variability.Source: §5.1.3 · pp. 14–15
  • The comparison baselines include periodic 1-fps snapshots, OCR with risk keywords, and GUIAuditor variants that omit distillation steps.Existing parental controls were not direct comparators because they do not target post-hoc, fine-grained in-app analysis.Source: §5.1.3 · pp. 15–16

5.1.4 Evaluation Metrics.

  • Evaluation metrics cover event logging and five-category labeling, factual correctness of summaries, evidence-token volume, retrieval ranking and recall, follow-up accuracy, and device costs.For retrieval, the reported measures include MRR and Recall@K for K=1 and K=3.Source: §5.1.4 · p. 16

5.2 RQ1: Provenance Fidelity

GUIAuditor logs significant events and labels their risk types with high fidelity while reducing the visual evidence requiring analysis. Generated descriptions are mostly factual, and the evaluation characterizes performance across risk categories, participant cohorts, and sampling settings.

5.2 RQ1: Provenance Fidelity

  • 88.47% (261/295) of generated descriptions were factually correct and non-hallucinatory; reported errors included 6.44% logging-only and 5.08% classification-driven.Logging-only errors could contain a minor factual mistake even when the risk was correctly identified.Source: §5.2 · pp. 17–18
  • Risk recall was 98% for Content and Contact, 95% for Financial, and 91% for Privacy; adult and underage Macro-F1 were 94.65% and 94.90%.Figure 3’s diagonal counts correct classifications and its off-diagonal counts misclassifications, with predicted categories in rows and ground truth in columns.Source: §5.2 · p. 17, Figure 3 · p. 18
  • 2,476 tokens per clip versus MineContext’s 22,850 represents a reduction of over 89.2%, with comparable effectiveness to periodic snapshots.GUIAuditor’s full framework achieved this fidelity-to-cost trade-off by processing substantially less visual evidence.Source: §5.2 · p. 18
  • Action-guided adaptive sampling alone reduced tokens by 79.0%; deduplication and semantic compression reduced them further while Macro-F1 remained around 95%.The study reports that each distillation stage removes redundant data while retaining essential semantic signals.Source: §5.2 · p. 18
  • At 2 fps and 2s, GUIAuditor achieved 95.23% Macro-F1 at 2,476 tokens; using 1 fps or a 1s window lowered Macro-F1 by 8.42% or 6.10%.Increasing the rate to 4 fps yielded only a 0.33% gain while roughly doubling token overhead; longer windows also inflated token counts without proportional accuracy gains.Source: §5.2 · p. 18, Figure 4 · p. 19
  • Each action starts with 4 candidate frames, deduplicates to 1.6 visually distinct frames on average, then passes 18.5% of original visual tokens to the MLLM.The downstream deduplication stages keep per-event MLLM inference cost bounded even during rapid, continuous interaction bursts.Source: §5.2 · p. 19
  • 98.72% F1-Score for significant-event logging and 95.23% Macro-F1 for risk labeling show high provenance fidelity; labeling is competitive with MineContext at 97.98% Macro-F1.The OCR-based baseline achieved 46.98% Macro-F1, while GUIAuditorNaive failed to produce valid results for most test cases.Source: §5.2 · pp. 17, 19

5.3 RQ2: Forensic Capability

GUIAuditor’s two-stage query engine retrieves relevant events from natural-language questions and answers follow-up questions about specific events. Its evaluation also exposes a failure mode: a correct risk label can coexist with a summary that misses contextual meaning.

5.3 RQ2: Forensic Capability

  • The 68-question test set comprised 51 retrieval questions and 17 interrogation questions, curated from parental concerns and mapped to ground-truth events.The questions included cross-category and open-ended inquiries intended to test semantic retrieval rather than simple category matching.Source: §5.3 · pp. 19–20, Table 4 · p. 20
  • 90.20% Recall@1, 94.12% Recall@3, and 0.9234 MRR were achieved for event retrieval across 51 natural-language questions.Table 4 reports Stage 1 retrieval metrics separately from Stage 2 interrogation accuracy.Source: Table 4 · p. 20, §5.3 · p. 20
  • 88.24% accuracy was achieved when answering 17 detail-oriented follow-up questions about pre-identified events.The questions tested extraction of details such as monetary amounts and usernames from stored visual evidence.Source: §5.3 · p. 20, Table 4 · p. 20
  • A correctly labeled content-risk event still produced a failed semantic query when its summary omitted the post’s religious metaphor.The case involved a GIF of frying pork paired with inflammatory text; broader queries could still reach the preserved evidence.Source: §5.3 · p. 20

5.4 RQ3: On-Device Performance Overhead

Across three modern smartphones, GUIAuditor’s measured on-device overhead was lower than the alternatives described in the evaluation. The one-hour mixed-use test also found that dense event bursts can delay guardian review, though not the child’s ongoing interaction.

5.4 RQ3: On-Device Performance Overhead

  • The overhead test ran each method five times per device during continuous one-hour sessions covering social media, short videos, chats, and in-app transactions.Power and temperature results are reported as cross-device averages over normal phone use.Source: §5.4 · p. 21
  • 2.1W power draw, 2.1°C temperature increase, 7.4s/event latency, and 3.1GB peak memory were measured for GUIAuditor under the one-hour workload.The measurements are averaged across three smartphones; the figure reports deltas over normal phone use for power and temperature.Source: Figure 5 · p. 21, §5.4 · p. 21
  • GUIAuditorMineContext draws 5.2W and needs 46.1s/event and 6.7GB peak memory, while GUIAuditornaive draws 7.5W and is killed for exceeding device RAM.GUIAuditorMineContext’s uniform sampling produces more visual tokens; the naive approach cannot complete inference.Source: §5.4 · p. 21, Figure 5 · p. 21
  • Dense event bursts can create a temporary inference backlog that delays guardian access to records, but inference runs after interactions and does not block the child’s device use.Source: §5.4 · p. 21
  • 5.9MB of provenance records were stored per hour; the average 113 records each occupy 51.7KB.At 2–4 hours of daily screen time, the paper estimates 11.8–23.6MB of daily storage before No Risk records are discarded.Source: §5.4 · p. 22

6 DISCUSSIONS

GUIAuditor’s post-hoc, human-in-the-loop design preserves context for guardians while avoiding disruption to children’s routine phone use. The discussion also addresses coercive-control risks, privacy safeguards, and limitations in model capability, participant scale, and risk coverage.

6.1 Necessity of the Human-in-the-Loop Paradigm

  • Guardians need contextual understanding to respond appropriately, while uninterrupted phone use matters to children; real-time false positives can disrupt routine tasks and erode trust.The paper argues these needs remain even as models improve.Source: §6.1 · pp. 22–23
  • GUIAuditor complements rather than replaces real-time defenses: immediate single-session harms still need prevention, and dense event bursts may delay records for guardians.Asynchronous analysis does not block the child’s interaction.Source: §6.1 · p. 23

6.2 Risk of Coercive Control

  • In coercive or imbalanced relationships, GUIAuditor could be weaponized; proposed mitigations include relationship checks, anti-coercion measures, monitoring safeguards, audit logs, and policy enforcement.The authors frame these as directions for future work, not implemented protections.Source: §6.2 · p. 23

6.3 Privacy and Data Security Considerations

  • Deployment is predicated on guardian consent, with children involved through age-appropriate explanations and older minors’ acknowledgement.The discussion connects transparency and fairness to GDPR guidance.Source: §6.3 · p. 23
  • Analysis runs exclusively on-device without transmitting screen content; the system persists only minimal visual evidence for significant events.The authors report that the full pipeline ran on three modern smartphones under their measured workload.Source: §6.3 · pp. 23–24
  • GUIAuditor captures around discrete interaction events, discards data for events classified as “No Risk,” and presents summaries and targeted queries instead of raw recordings.Filesystem encryption or a TEE could further harden provenance records, though this is orthogonal to the core contribution.Source: §6.3 · p. 24

6.4 Limitations and Future Work

  • Semantic summaries depend on MLLM reasoning, which can miss complex, implicit, or culturally specific cues, although preserved evidence remains available for broader retrieval and Stage 2 queries.One failure case correctly classified a Content Risk but overlooked a malicious religious metaphor.Source: §6.4 · p. 24
  • Recruitment yielded 32 participants from over 1,000 contacted families; scripted tasks and researcher-curated queries cannot fully represent longitudinal in-the-wild use or guardian questions.The 295-clip dataset spans legally significant age bands and showed comparable results across adult and underage cohorts.Source: §6.4 · p. 24

7 RELATED WORK

Related work spans qualitative studies of children’s online safety and LLM-based GUI automation, but GUIAuditor focuses on auditing human interactions for safety. Its technical challenge is producing a faithful, verifiable record for human-led investigation.

Child Online Safety

  • Qualitative research documents children’s online-risk landscape across emerging domains, while GUIAuditor focuses on building a technical system for post-hoc forensic analysis.Source: §7 · p. 25

GUI Automation and Testing Agents

  • GUI automation agents prioritize task completion, whereas GUIAuditor audits a human’s interactions for safety.Source: §7 · p. 25
  • Auditing human interactions creates a distinct challenge: prioritizing a faithful, verifiable record for human-led investigation.Source: §7 · p. 25

8 CONCLUSION

The paper presents GUIAuditor as a human-in-the-loop, post-hoc alternative to fully automated detection for complex in-app risks. Its evaluation reports accurate forensic investigation with moderate overhead, including on-device operation on current smartphones under the measured workload.

8 CONCLUSION

  • GUIAuditor introduces GUI Provenance, a structured, queryable record of interaction sequences that translates raw GUI streams into contextual evidence for guardians.Source: §8 · p. 25
  • The evidence-distillation pipeline and two-stage query engine support accurate forensic investigation with moderate overhead in a comprehensive benchmark evaluation.Source: §8 · p. 25
  • The full pipeline, including evidence distillation and on-device MLLM inference, ran on three modern smartphones under the measured workload.The authors frame the work as a foundation for tools that assist and empower, rather than replace, human guardians.Source: §8 · p. 25

9 APPENDIX

The authors report using ChatGPT 4.5 and 5.1 for editorial improvements, with outputs inspected and refined by the authors.

9.1 Declaration of Generative AI Usage

  • The authors used ChatGPT 4.5 and 5.1 during manuscript preparation.Source: §9.1 · p. 29
  • The prompts were limited to editorial requests for style, phrasing, and grammar, not generating scientific concepts or manuscript content.Source: §9.1 · p. 29
  • The authors say they inspected and refined AI outputs and retain full responsibility for the manuscript.Source: §9.1 · p. 29
Loading 2609.28205v1…