mlsanityData to 7 Oct 2026

Systematic Categorization, Construction and Evaluation of New Attacks against Multi-modal Mobile GUI Agents

arXiv 2407.09295 ↗First posted 12 Jul 2024cs.CRcited by 5

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

The integration of Large Language Models (LLMs) and Multi-modal Large Language Models (MLLMs) into mobile GUI agents has significantly enhanced user efficiency and experience. However, this advancement also introduces potential security vulnerabilities that have yet to be thoroughly explored. In this paper, we present a systematic security investigation of multi-modal mobile GUI agents, addressing this critical gap in the existing literature. Our contributions are twofold: (1) we propose a novel threat modeling methodology, leading to the discovery and feasibility analysis of 34 previously unreported attacks, and (2) we design an attack framework to systematically construct and evaluate these threats. Through a combination of real-world case studies and extensive dataset-driven experiments, we validate the severity and practicality of those attacks, highlighting the pressing need for robust security measures in mobile GUI systems.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 46 of its 71 references that are in the map. First posted on arXiv 12 Jul 2024.

Builds on

46 of 71 references.

Closest ancestors · 9

Same direction, newest first

  1. 2024Flooding Spread of Manipulated Knowledge in LLM-Based Multi-Agent Communities10 Jul
  2. 2024Dissecting Adversarial Robustness of Multimodal LM Agents18 Jun
  3. 2024BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents5 Jun
  4. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
  5. 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks2 Mar
  6. 2024WIPI: A New Web Threat for LLM-Driven Web Agents26 Feb
  7. 2024The Wolf Within: Covert Injection of Malice into MLLM Societies via an MLLM Operative20 Feb
  8. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents17 Feb
  9. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb

Other references · 37

  1. 2017Attention Is All You Needcited by 59,932
  2. 2020Language Models are Few-Shot Learnerscited by 32,199
  3. 2023GPT-4 Technical Reportcited by 18,132
  4. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,302
  5. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  6. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2023Qwen-VL: A Versatile Vision-Language Model for Understanding, Localization, Text Reading, and Beyondcited by 2,179
  10. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  11. 2023CogAgent: A Visual Language Model for GUI Agentscited by 692
  12. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
25 more
  1. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  2. 2024SeeClick: Harnessing GUI Grounding for Advanced Visual GUI Agentscited by 553
  3. 2023AppAgent: Multimodal Agents as Smartphone Userscited by 407
  4. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
  5. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 325
  6. 2023Android in the Wild: A Large-Scale Dataset for Android Device Controlcited by 314
  7. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  8. 2024Mobile-Agent-v2: Mobile Device Operation Assistant with Effective Navigation via Multi-Agent Collaborationcited by 187
  9. 2023You Only Look at Screens: Multimodal Chain-of-Action Agentscited by 185
  10. 2024Ferret-UI: Grounded Mobile UI Understanding with Multimodal LLMscited by 173
  11. 2024Android in the Zoo: Chain-of-Action-Thought for GUI Agentscited by 156
  12. 2024PLeak: Prompt Leaking Attacks against Large Language Model Applicationscited by 113
  13. 2022META-GUI: Towards Multi-modal Conversational Agents on Mobile GUIcited by 81
  14. 2024Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoningcited by 62
  15. 2024Prompt Stealing Attacks Against Large Language Modelscited by 39
  16. 2024Adversarial Search Engine Optimization for Large Language Modelscited by 37
  17. 2021Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descentcited by 34
  18. 2023The Philosopher's Stone: Trojaning Plugins of Large Language Modelscited by 31
  19. 2023VisionTasker: Mobile Task Automation Using Vision Based UI Understanding and LLM Task Planningcited by 28
  20. 2024Adversarial Robustness for Visual Grounding of Multimodal Large Language Modelscited by 23
  21. 2024Oedipus: LLM-enchanced Reasoning CAPTCHA Solvercited by 20
  22. 2023Reinforced UI Instruction Grounding: Towards a Generic UI Task Automation APIcited by 18
  23. 2024AutoScraper: A Progressive Understanding Web Agent for Web Scraper Generationcited by 18
  24. 2023When Vision Fails: Text Attacks Against ViT and OCRcited by 5
  25. 2024Transfer Attack for Bad and Good: Explain and Boost Adversarial Transferability across Multimodal Large Language Modelscited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 1; 2026: 2.

5 papers.

  1. 2024Large Language Model-Brained GUI Agents: A Surveycited by 160
  2. 2025A Survey on the Safety and Security Threats of Computer-Using Agents: JARVIS or Ultron?cited by 23
  3. 2026Defense Against Indirect Prompt Injection via Tool Result Parsingcited by 8
  4. 2024Seeing is Deceiving: Exploitation of Visual Pathways in Multi-Modal Language Modelscited by 4
  5. 2026Software Engineering for and with GUI Agentcited by 1

Similar, not cited

Close in wording, no citation either way

  1. 2025From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agents
  2. 2025Mobile GUI Agents under Real-world Threats: Are We There Yet?
  3. 2025Measuring the Security of Mobile LLM Agents under Adversarial Prompts from Untrusted Third-Party Channels
  4. 2025The Obvious Invisible Threat: LLM-Powered GUI Agents' Vulnerability to Fine-Print Injections
  5. 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem
  6. 2026On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models
  7. 2025Security Concerns for Large Language Models: A Survey
  8. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation