PaperlayerView exact revision on arXiv

Source-linked AI summary

Before Acting, Change the State: Prospective State Intervention for Web Agents under Deceptive Interfaces

Ruozhao Yang, Mingfei Cheng, Xiaofei Xie

arXiv:2609.34974v1cs.AIcs.CR

TL;DR

Web agents can be steered by deceptive interfaces, and a task-valid action may still realize an unauthorized consequence because of the current Web state. Veer plans prospective state interventions before modifying the live environment and verifies them during execution; it achieves the highest safe task completion in all three evaluation settings.

  • Problem

    A task-valid Web-agent action can still realize an unauthorized consequence because of the current Web state, while deceptive interfaces steer users toward outcomes they may not otherwise choose.

    Source: §1 · pp. 1–2

  • Method

    Veer identifies consequence-relevant state, plans a prospective intervention trajectory before live modification, then re-grounds and verifies each transition during execution.

    Source: §1 · p. 2

  • Results

    15.9 and 25.0 percentage points: Veer exceeds the next-highest safe task completion on TrickyArena-Single and TrickyArena-Multi, respectively, and achieves the highest STC in all three evaluation settings.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Task-relevant Web state is an effective runtime control target for safe Web-agent execution.

    Source: §6 · p. 8

    The runtime defense must infer relevant state from observable Web evidence, without privileged access to internal application state, a clean interface counterpart, or an explicit dark-pattern label.

    Source: §2 · p. 3

Abstract

from arXiv · show

LLM-based Web agents can autonomously complete user tasks, yet deceptive interfaces can steer them toward outcomes that conflict with users' interests. Existing defenses primarily intervene on agent behavior through blocking, guidance, or replanning. We identify a distinct failure mode: a task-valid action can still realize an unauthorized consequence because of the current Web state. This motivates treating task-relevant Web state itself as a runtime control target. We introduce Veer, an agent-side runtime defense that leaves task planning to the base agent and intervenes on Web state when a proposed action would produce an unauthorized consequence. Before modifying the live environment, Veer constructs a prospective intervention trajectory toward a safe task-relevant state and executes it with runtime grounding and verification. Across TrickyArena and WebDecept, Veer achieves the highest safe task completion in all three evaluation settings, exceeding the next-best defense by 15.9 and 25.0 percentage points on TrickyArena-Single and TrickyArena-Multi, respectively, while reducing dark-pattern success on WebDecept to 0.3%. These gains persist across dark-pattern types and all 12 agent, model, and benchmark configurations. Ablations show that active state intervention provides the largest gain, while prospective rollout and temporal evidence contribute additional improvements. These results establish task-relevant Web state as an effective runtime control target for protecting Web agents from deceptive outcomes.

1 INTRODUCTION

The introduction identifies a gap in action-centric defenses: a task-valid action can still produce an unauthorized consequence because of the Web state at execution. Veer plans and verifies a state intervention before returning control to the base agent.

Motivation

  • Action-centric defenses leave unresolved cases where a task-valid action produces an unauthorized consequence because of the Web state at execution.For example, checkout may remain appropriate while an auto-added warranty changes the outcome.Source: §1 · pp. 1–2, Figure 1 · p. 2

Challenges

  • Prospective intervention must connect sparse, persistent state evidence to user intent, plan dependent transitions before actuation, and verify effects against the live interface.Trying candidate interventions directly can modify the live application, while dynamic content or failed interactions can invalidate planned transitions.Source: §1 · p. 2

Approach

  • Veer uses current and temporal evidence to identify consequence-causing state, plans an intervention objective and trajectory, then re-grounds and verifies each transition during execution.Control returns to the base agent once the objective is satisfied.Source: §1 · p. 2

Evaluation and contributions

  • Veer achieves the highest safe task completion in all three evaluation settings, exceeding the next-highest result by 15.9 and 25.0 percentage points on TrickyArena-Single and TrickyArena-Multi.It reduces dark-pattern success on WebDecept to 0.3%; gains persist across 471 benchmark configurations.Source: §1 · p. 2
  • The paper establishes task-relevant Web state as a runtime control target and evaluates Veer against dark-pattern-specific and general agent-safety defenses.The evaluation spans TrickyArena and WebDecept and reports gains across deceptive conditions and agent–model configurations.Source: §1 · p. 2

2 PRELIMINARY

The preliminary section models Web-agent tasks as multi-step browser interactions and distinguishes task-valid actions from their potentially unauthorized consequences. It defines the runtime defense as an agent-side layer operating through observable browser evidence, without privileged application access.

Web-agent execution

  • A Web agent completes a natural-language task through multi-step browser interactions, with each action producing a subsequent observation.The base-agent policy proposes actions from the current observation and interaction history.Source: §2 · p. 3

Task-relevant action consequences

  • Task-relevant Web state comprises conditions such as selected options, saved settings, or workflow state that can shape an action’s consequence.An outcome is unauthorized when it is unsupported by the user task, even if the action itself is task-valid.Source: §2 · p. 3

Runtime defense setting

  • The runtime defense acts between the base agent and website through available browser operations, inferring relevant state from observable evidence without privileged access or explicit dark-pattern labels.It receives the task, current observation, interaction history, and proposed action before execution.Source: §2 · p. 3

3 Veer: CONSEQUENCE-GUIDED STATE INTERVENTION

Veer couples task-grounded consequence assessment with prospective state intervention and guarded live execution. Its intervention objective remains fixed while browser-level actions are grounded and verified against the evolving interface.

3 Veer: CONSEQUENCE-GUIDED STATE INTERVENTION

  • Veer couples task-grounded consequence assessment, prospective state intervention, and guarded trajectory execution through an explicit intervention objective.The objective remains fixed while the browser-level trajectory can adapt to evidence observed during intervention.Source: §3 · p. 3

3.1 TASK-GROUNDED CONSEQUENCE ASSESSMENT

  • Task-grounded assessment combines dynamic Web state from current and valid temporal evidence with a stable authorization representation derived from the user instruction.Runtime observations can ground authorization references but cannot expand what the user permitted.Source: §3.1 · pp. 3–4

3.2 PROSPECTIVE STATE INTERVENTION

  • For an unauthorized predicted consequence, Veer specifies the responsible state, the safe target state, and task-relevant state to preserve, then plans dependent browser transitions before changing the live application.It checks that trajectory targets are grounded, dependencies valid, and effects consistent with the intervention objective before execution.Source: §3.2 · p. 4

3.3 GUARDED TRAJECTORY EXECUTION

  • Veer re-grounds each planned transition, verifies its observed effect, and proceeds to dependent steps only after confirmation.A mismatch invalidates the remaining trajectory; Veer re-grounds actual state and replans when a valid continuation can still meet the same objective, then returns the updated state to the base agent.Source: §3.3 · p. 4

4 EXPERIMENTS

Veer achieves the highest safe task completion across all three evaluation settings, with gains robust across deceptive conditions and agent–model configurations. Ablations show that active state intervention contributes most, while prospective rollout and temporal evidence provide additional benefits.

4.1 EXPERIMENTAL SETUP

  • The evaluation uses TrickyArena and WebDecept, matching task configurations, base agents, actor models, and base task-step allowances across methods within each benchmark.Safe Task Completion requires successful task completion without an evaluated dark-pattern outcome.Source: §4.1 · pp. 4–5

4.2 RQ1: OVERALL EFFECTIVENESS

  • 85.2% STC on TrickyArena-Single, 67.6% on TrickyArena-Multi, and 41.0% on WebDecept give Veer the highest STC in all three settings.On the ground-truth-feasible WebDecept subset, Veer achieves 57.3% TSR and STC while reducing DPSR to 0.0%.Source: Table 1 · p. 5, §4.2 · pp. 5–6, Table 2 · p. 5

4.3 RQ2: ROBUSTNESS ACROSS DECEPTIVE CONDITIONS AND AGENT–MODEL CONFIGURATIONS

  • Veer’s mean per-category DPSR is 5.7% on TrickyArena-Single, and it has the lowest or tied-lowest DPSR in 21 of 22 categories.On WebDecept, Veer records one deceptive outcome across 315 configurations, with 0.3% mean per-scenario DPSR and 2.2% worst-case DPSR.Source: §4.3 · p. 6, Figure 3 · p. 6
  • From TrickyArena-Single to Multi, Veer’s DPSR rises by 10.2 points and STC falls by 17.6 points, the smallest aggregate deteriorations among methods.The benchmark settings have different configuration mixtures, so the comparison uses aggregate changes rather than paired conditions.Source: §4.3 · p. 7
  • Across 12 agent–model–benchmark comparisons, Veer improves STC over matched No-Defense by 4.8–29.4 points and decreases DPSR by at least 20.5 points.The comparisons use Default and Codex agents paired with GPT-5.6-Luna or DeepSeek-V4-Flash.Source: §4.3 · p. 7

4.4 RQ3: CONTRIBUTION OF CORE DESIGN CHOICES

  • Replacing active state intervention with blocking reduces TSR from 86.4% to 51.1% and STC from 85.2% to 50.0%, the largest ablation degradation.Episodes with neither task completion nor a dark-pattern outcome rise from 10.2% to 38.6%; intervention instead resolves the responsible state and returns control to the base agent.Source: §4.4 · p. 7, Figure 4 · p. 7
  • Replacing prospective rollout with reactive intervention raises DPSR from 4.5% to 6.8% and lowers STC to 80.7%, while TSR remains nearly unchanged.Successful episodes containing a dark-pattern outcome rise from 1.1% to 4.5%.Source: §4.4 · p. 7
  • Removing temporal evidence reduces TSR from 86.4% to 80.7% and STC from 85.2% to 77.3%.Task failures without a dark-pattern outcome increase from 10.2% to 17.0%, and successful episodes with a dark-pattern outcome increase from 1.1% to 3.4%; temporal evidence helps retain task-relevant state across observations.Source: §4.4 · pp. 7–8

5 RELATED WORK

Related work studies deceptive interfaces, runtime safety, and planning and state reasoning for interactive agents. Veer differs by intervening on task-relevant Web state when that state makes a task-valid action produce an unauthorized consequence.

Dark Patterns and Deceptive Web Interfaces

  • Prior work studies dark-pattern taxonomies, prevalence, and effects, as well as deceptive patterns in Web-agent tasks and deception-aware guidance.The paper positions Veer as intervening on Web state when that state causes a task-valid action to realize an unauthorized consequence.Source: §5 · p. 8

Runtime Safety for Interactive Agents

  • Runtime safety approaches use input isolation, action verification, or consequence prediction for screening, guidance, and replanning; Veer changes the state determining an action’s consequence.The paper characterizes prior approaches as mainly controlling how an action proceeds.Source: §5 · p. 8

Planning and State Reasoning for Interactive Agents

  • Interactive-agent planning work includes search, hierarchical planning, memory, state prediction, and predicted-state planning for Web agents.Veer uses prospective state reasoning for runtime safety, deriving transitions toward a safe state before live modification and verifying them during execution.Source: §5 · p. 8

6 CONCLUSION

The conclusion presents consequence-guided state intervention as a runtime control target for Web agents. Veer combines prospective intervention and guarded execution, achieves the highest safe task completion in all three settings, and shows additional gains from rollout and temporal evidence.

Conclusion

  • Consequence-guided state intervention targets Web states that can make task-valid actions produce unauthorized consequences.The conclusion identifies task-relevant Web state as an effective runtime control target.Source: §6 · p. 8
  • Veer combines explicit intervention objectives, prospective state intervention, and guarded live execution to modify consequence-causing state while preserving task progress.Source: §6 · p. 8
  • Across TrickyArena and WebDecept, Veer achieves the highest safe task completion in all three evaluation settings and remains effective across deceptive conditions and agent–model configurations.Ablations identify active intervention as the largest contributor, with prospective rollout and temporal evidence providing additional gains.Source: §6 · p. 8

AI USE STATEMENT

Generative AI assisted with English-language editing and polishing and with writing and refining parts of the experimental code. The authors say it was not used for research formulation, methodology, or experimental interpretation, and that they reviewed and verified AI-assisted text and code.

AI USE STATEMENT

  • Generative AI tools assisted with English-language editing and polishing of the manuscript.Source: AI USE STATEMENT · p. 9
  • Generative AI tools also assisted with writing and refining parts of the experimental code.Source: AI USE STATEMENT · p. 9
  • The authors state that AI tools were not used for research questions, hypotheses, conceptual framework, methodology, experimental design, evaluation protocol, or results interpretation.The authors reviewed and verified all AI-assisted text and code and take responsibility for the final content.Source: AI USE STATEMENT · p. 9

ETHICS STATEMENT

Veer assesses proposed actions against task authorization and current Web state, then intervenes on state when an action would realize an unauthorized consequence. It plans before changing the live environment and verifies each transition before returning control to the base agent.

ETHICS STATEMENT

  • The work studies deceptive-interface defenses in controlled Web benchmarks, without human subjects or collection of personal or sensitive user data.The authors note that the techniques could potentially be adapted beyond defensive purposes.Source: ETHICS STATEMENT · p. 9

A.1 OVERALL RUNTIME PROCEDURE

  • Veer evaluates each proposed action against task authorization and current task-relevant Web state before releasing it.An uncertain assessment triggers bounded evidence acquisition and reassessment; unresolved uncertainty is not treated as authorization.Source: A VEER RUNTIME ALGORITHM · p. 12, §A.1 · p. 12, §A.2 · p. 12

A.3 PROSPECTIVE INTERVENTION CONSTRUCTION

  • For an unauthorized consequence, Veer fixes an intervention objective and constructs the complete remaining browser trajectory before changing the live environment.The objective specifies the responsible state, target safe state, and task-relevant state to preserve; the trajectory records ordered transitions and dependencies.Source: §A.3 · pp. 12–13
  • Veer admits a prospective trajectory only when its targets are groundable, dependencies are well formed, and the trajectory matches the fixed objective.If these conditions are not met, the intervention is not committed to the live environment.Source: §A.3 · pp. 13–14

A.4 GUARDED EXECUTION AND REPLANNING

  • During execution, Veer re-observes the interface, re-grounds each target, checks dependencies, and verifies the observed state change against the planned effect.A mismatch invalidates the remaining trajectory and can trigger replanning under the same objective.Source: §A.3 · p. 13, §A.4 · p. 14
  • Veer returns control only after the safe target state is established, task-relevant progress is preserved, and the responsible state is resolved.If those conditions cannot be established within the bounded procedure, Veer does not release the unresolved unsafe execution.Source: §A.3 · p. 13, §A.4 · p. 14

B STRUCTURED REPRESENTATIONS, SCHEMAS, AND PROMPTS

Veer assembles task-grounded representations from the user instruction, current Web observations, retained evidence, and structured model outputs. Its intervention objective is separated from action planning, allowing a fixed state-level target to be realized through a prospective, verified browser trajectory.

B.1 TASK AUTHORIZATION REPRESENTATION

  • Authorization is extracted from the original user instruction and separates authorized outcomes, constraints, requested information, and output targets.Runtime evidence may bind task references to Web objects, but cannot expand the user’s authorization; unsupported authorization spans are discarded.Source: §B.1 · p. 14, Figure 5 · p. 15

B.2 TASK-RELEVANT WEB STATE AND TEMPORAL EVIDENCE

  • Task-relevant Web state combines current observations with retained temporal evidence, which is filtered as interface state changes.Retained evidence includes prior transitions, verified findings, assessed actions, and unresolved anomalies; stale evidence is distinguished from current facts.Source: §B.2 · p. 15

B.3 CONSEQUENCE ASSESSMENT REPRESENTATION

  • Consequence assessment represents predicted commitments and their before-and-after states, causal triggers, evidence, and reversibility.When evidence is insufficient, Veer can request additional evidence and retain an uncertain decision for bounded reassessment rather than attributing a later-action outcome to the current proposal.Source: §B.3 · p. 16, Figure 6 · p. 16

B.4 INTERVENTION OBJECTIVE

  • The intervention objective specifies the risk-causing state, corrected target state, and task-relevant state to preserve, without prescribing browser actions.This separation keeps the target fixed while allowing the concrete trajectory to adapt to the interface.Source: §B.4 · p. 17

B.5 PROSPECTIVE TRANSITION REPRESENTATION

  • Each prospective transition records a corrective operation, grounded target, expected local post-state, and dependencies on earlier transitions.The example trajectory disables two settings before a dependent save transition.Source: §B.5 · p. 17, Figure 7 · p. 18
  • Prospective rollout declares the complete remaining correction trajectory before actuation, including expected post-states and cross-step dependencies.It does not assume a learned simulator; live divergence invalidates the remaining trajectory and can trigger replanning under the same objective.Source: §B.5 · p. 17, Figure 7 · p. 18

C EXPERIMENTAL CONFIGURATION

The appendix specifies Veer’s runtime configuration, benchmarks, baseline adaptations, and evaluation protocol. Comparisons use shared task configurations and base-agent budgets, while Veer reserves its internal budget for defense operations.

C EXPERIMENTAL CONFIGURATION

  • Veer operates between base-agent action generation and browser execution, with compared methods using the same task configurations, agent, actor model, and base task-action allowance within each benchmark.Veer’s internal budget is reserved for defense-side evidence acquisition and state intervention, not ordinary task execution.Source: C EXPERIMENTAL CONFIGURATION · p. 18, §D.4 · p. 23

C.1 MAIN SYSTEM CONFIGURATION

  • Main experiments use each benchmark’s native agent with GPT-5.6-Luna, and Veer receives no hidden evaluator outputs, dark-pattern labels, or backend application state.The host interaction stacks differ between TrickyArena and WebDecept, and Veer is integrated at the action boundary.Source: §C.1 · pp. 18–19

C.2 MODEL AND STRUCTURED-OUTPUT SETTINGS

  • Veer’s model-backed components use structured outputs that are parsed and checked before they can affect browser execution.Assessment can request bounded evidence acquisition, while objective construction and prospective planning must satisfy their structured contracts before trajectory admission.Source: §C.2 · p. 19

C.3 INTERACTION AND RUNTIME BUDGETS

  • Defense-side browser operations and re-observations are accounted for separately from the common base-agent task-action budget.Runtime bounds limit evidence attempts and replanning; unresolved decisions are not promoted to authorization.Source: §C.3 · p. 19, Table 5 · p. 20

C.4 AGENT–MODEL CONFIGURATIONS

  • The agent–model analysis varies two agent implementations and two model families, with Veer using the same model family as each corresponding base agent.Default+GPT is the main configuration used for RQ1 and RQ3.Source: §C.4 · p. 20, Table 6 · p. 20

D.1 TRICKYARENA

  • TrickyArena evaluates 88 single-pattern and 68 multi-pattern configurations; WebDecept evaluates 315 task–scenario configurations across 45 shopping tasks.The TrickyArena-Multi configurations contain two to four active deceptive conditions.Source: §D.1 · p. 20, §D.2 · p. 21, Table 7 · p. 21

D.3 FEASIBILITY-AWARE WEBDECEPT SUBSET

  • The feasibility-aware WebDecept subset contains 225 configurations from five scenarios with benchmark-defined safe completion paths, and is reported alongside—not instead of—the full benchmark.Baseline adaptations map methods to the host interfaces without adding Veer’s state-intervention mechanism.Source: §D.3 · pp. 21–22, §D.4 · pp. 22–23

E.1 EVALUATION PROTOCOL

E.3 PER-CONDITION RESULTS

The appendix reports per-condition outcomes and agent–model comparisons, alongside the scope of its additional ablation and trajectory analyses. Veer’s reported gains extend across the evaluated agent–model–benchmark comparisons.

E.3 PER-CONDITION RESULTS

  • Across WebDecept, Veer records one deceptive outcome among 315 configurations, with a 0.3% unweighted mean per-scenario DPSR and a 2.2% maximum scenario DPSR.Table 13 reports complete WebDecept results over all seven scenarios.Source: §E.3 · p. 24, Table 13 · p. 25

E.4 AGENT–MODEL RESULTS

  • Veer improves STC over matched No-Defense in all 12 agent–model–benchmark comparisons.The appendix reports these as the complete system-configuration results corresponding to the main-paper comparison.Source: §E.4 · p. 24

F ADDITIONAL ABLATION AND TRAJECTORY ANALYSIS

  • The additional RQ3 ablations and trajectory analyses use TrickyArena-Single with 88 configurations per variant, holding tasks, agent, model, and task-action allowance constant unless an ablation removes them.The variants retain the surrounding Veer runtime components unless explicitly removed.Source: F ADDITIONAL ABLATION AND TRAJECTORY… · p. 25

F.1 COMPLETE ABLATION RESULTS

The ablations show that corrective state intervention is central to Veer’s task progress, while prospective rollout and temporal evidence add further gains. Trajectory analyses and episodes illustrate why interventions must preserve dependent corrections and verify the resulting state.

F.1 COMPLETE ABLATION RESULTS

  • Blocking instead of corrective state intervention lowers TSR from 86.4% to 51.1% and STC by 35.2 percentage points.The blocking variant rejects the proposed action without issuing a corrective browser action.Source: §F.1 · p. 25
  • Removing complete prospective rollout raises DPSR from 4.5% to 6.8% and lowers STC from 85.2% to 80.7%, while TSR remains close to Full Veer.Reactive Intervention constructs each next transition only after observing the result of the previous one.Source: §F.1 · p. 25
  • Removing retained temporal evidence lowers TSR from 86.4% to 80.7% and STC from 85.2% to 77.3%.This variant retains the current Web observation and the base agent’s normal interaction context.Source: §F.1 · p. 25

F.2 ADDITIONAL ONE-STEP ABLATION

  • The stricter one-step variant lowers STC from 85.2% to 61.4% and raises DPSR from 4.5% to 14.8%.Unlike reactive intervention, it permits only one local corrective action per interception and does not represent or verify cross-step dependencies.Source: §F.2 · p. 26

F.3 INTERVENTION-TRAJECTORY ANALYSIS

  • Across 24 admitted trajectories, mean planned length is 1.88 transitions, median length is one, and maximum length is four.Four-transition trajectories confirm that evaluated interventions include dependent multi-step corrections.Source: §F.3 · p. 26

F.4 REPRESENTATIVE INTERVENTION TRAJECTORIES

  • Representative episodes show Veer correcting consent state while preserving task capabilities, then returning control for successful task completion.In one episode Veer verifies the corrected state after a locally successful interaction fails to meet the objective, then replans a continuation.Source: §F.4 · p. 27

G SCOPE AND LIMITATIONS

Veer’s scope depends on observable Web evidence, browser-reachable corrections, task-grounded authorization, identifiable preservation requirements, and the base agent’s continued task planning. Its evaluation covers three settings, with broader Web environments left for future work.

Observable-state dependence

  • Veer targets consequences whose relevant pre-commit state is observable in the Web interaction; effects determined entirely by hidden server-side state fall outside its current model.It constructs task-relevant state from the current observation and retained temporal evidence.Source: G SCOPE AND LIMITATIONS · p. 28

Browser-reachable correction

  • Intervention requires a browser-level path to the target state, and dynamic interfaces or unexpected transition effects can invalidate a prospective trajectory.Veer grounds actions live, checks dependencies, verifies transitions, and replans when a valid continuation remains available.Source: G SCOPE AND LIMITATIONS · p. 28

Task-grounded authorization

  • Because authorization derives from the original user instruction, insufficiently specified task intent can leave proposed consequences uncertain.Web observations can ground task references but do not expand the authorization boundary.Source: G SCOPE AND LIMITATIONS · p. 28

Task-state preservation

  • Veer preserves task-relevant state and capabilities only when they can be identified from the interaction evidence available to it.Guarded execution checks declared preservation requirements together with the target corrected state before returning control.Source: G SCOPE AND LIMITATIONS · p. 28

Base-agent dependence

  • Veer does not replace the base agent’s task planner, so navigation, retrieval, and remaining task completion still depend on that agent.Veer intervenes on consequence-causing Web state and then returns control to the base agent.Source: G SCOPE AND LIMITATIONS · p. 28

Evaluation scope

  • Evaluation covers TrickyArena-Single, TrickyArena-Multi, and WebDecept; extending it to additional Web environments and interaction settings remains future work.The experiments establish effectiveness in the evaluated settings.Source: G SCOPE AND LIMITATIONS · p. 28
Loading 2609.34974v1…