研究者发现GUI模型把坐标当数字token生成时容易被攻击，MissClick在OS-Atlas和UGround上能把点击位置带偏，成功率比现有攻击高出几十个百分点。
GUI视觉定位模型将屏幕坐标生成为数字token序列，再解析为数值执行点击。MissClick针对坐标的数字位权结构提出两种攻击目标：MissClick-U最大化软坐标位移实现无目标干扰，MissClick-T最小化按位加权的目标数字损失实现定向劫持。在OS-Atlas和UGround的桌面、网页与移动端基准上，MissClick-U的无目标攻击成功率达75.07%和72.93%，较现有攻击分别提升16.62和30.72个百分点。MissClick-T的目标攻击成功率达44.86%和62.67%，分别提升31.73和47.06个百分点。实验表明软坐标位移最适合无目标攻击，而按位加权的目标数字优化最适合定向攻击。
MissClick: Exploiting Digit-Serialized Coordinates to Attack GUI Grounding Models
Recent GUI visual grounding models generate screen coordinates as sequences of digit tokens that are parsed into numerical values and mapped to executable clicks. The security implications of this coordinate generation process have been largely overlooked. We observe that each coordinate digit is predicted as a categorical token, yet after parsing, changing a hundreds-place digit by one changes the corresponding numerical coordinate component by 100 units, which can induce a large displacement of the executed click. This observation motivates attack objectives that account for the numerical and place-value structure of coordinate outputs rather than treating them as ordinary text. Moreover, untargeted and targeted attacks impose different success conditions--displacing the click outside the correct region versus into an attacker-specified region--and therefore benefit from different objectives. We propose MissClick, a simple and effective white-box adversarial attack with two goal-specific objectives: MissClick-U maximizes soft-coordinate displacement for untargeted disruption, while MissClick-T minimizes a place-weighted target-digit loss for targeted hijacking. Compared with existing attacks against GUI grounding models on OS-Atlas and UGround across desktop, web, and mobile platforms, MissClick-U achieves untargeted success rates of 75.07\% and 72.93\% (+16.62 and +30.72 pp), and MissClick-T achieves targeted success rates of 44.86\% and 62.67\% (+31.73 and +47.06 pp). Attack objective comparison further shows that soft-coordinate displacement yields the highest untargeted attack success rate, whereas place-weighted target-digit optimization yields the highest targeted attack success rate, revealing distinct objective preferences for the two attack goals.