MobileProbe：基于轨迹感知注入的移动智能体安全评估框架
MobileProbe: Adaptive Security Evaluation of Mobile Agents via Trajectory-Aware Injection
做手机 GUI 智能体或相关安全工作的话，这篇值得看：它不靠人工写死攻击载荷，而是顺着智能体实际执行轨迹自动找注入点，83 个实例覆盖 12 个应用，攻击成功率比人工和零样本 LLM 基线都高，可以直接当部署前审计工具用。
MobileProbe 是一个针对移动 GUI 智能体的自适应红队评估框架，用于检测环境注入攻击（EIA）风险。攻击者可在普通 UI 内容中嵌入恶意指令，劫持正在代用户操作手机应用的智能体。论文构建了覆盖 12 个移动应用、共 83 个长程攻击实例的基准，每个实例均标注保密性、完整性或可用性（CIA）攻击目标。
框架工作流程分三步：通过自动化渗透测试发现攻击者可控的内容表面，沿智能体执行轨迹定位易受攻击的决策点，再经代理模型过滤的进化循环迭代优化上下文相关载荷。相比固定步骤注入的传统基准，这种轨迹感知方式能覆盖智能体实际走到注入页面的路径，避免把未触达攻击页面的运行误判为安全。
在三种代表性智能体架构上，MobileProbe 的攻击成功率超过人工编写载荷、零样本 LLM 生成以及此前适配移动场景的自动化红队基线。作者定位其为部署前审计工具，可用于系统化挖掘漏洞并指导移动智能体的安全加固。
MobileProbe: Adaptive Security Evaluation of Mobile Agents via Trajectory-Aware Injection
Mobile GUI agents read the screen of a phone and operate apps on a user's behalf to complete multi-step tasks such as online shopping or messaging. Because the agent acts on whatever the screen shows, an attacker can embed malicious instructions into ordinary UI content and redirect its actions. We refer to this threat as environmental injection attack (EIA). Existing benchmarks measure this risk by pinning hand-crafted payloads to a fixed step of a fixed task. This approach faces two limitations. First, each payload is bound to one task in one app and does not transfer without manual redesign. Second, agents given the same task may follow different routes, so an agent that never reaches the injected page is recorded as safe without being tested. This insufficient test coverage can cause fixed-point benchmarks to underestimate the security risk of deployed mobile agents. In this work, we propose MobileProbe, a trajectory-aware red-teaming framework that evaluates mobile agents adaptively. MobileProbe discovers attacker-controllable content surfaces through automated pentesting, localizes vulnerable decision points along the agent's trajectory, and iteratively refines context-aware payloads through a surrogate-filtered evolutionary loop. We construct a benchmark of 83 long-horizon attack instances spanning 12 mobile applications. Each is annotated with a Confidentiality, Integrity, or Availability (CIA) attack goal to cover the principal categories of security threats facing mobile agents. On three representative agent architectures, MobileProbe attains higher attack success rates than human-written, zero-shot LLM, and prior automated red-teaming baselines adapted to the mobile domain. MobileProbe can serve as a pre-deployment auditing tool to systematically uncover vulnerabilities and inform security hardening of mobile agents.
This report is categorized under AITOP's "Papers" desk, focusing on China's AI industry and domestic foundation model ecosystem. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include MobileProbe, GUI智能体, AI安全, 红队测试.
Source attribution: curated from arXiv cs.AI (@Yingbin Jin, Ji'an Wang, HaoYang Chai, Hanjun Luo, Li Hu, Xinfeng Li, Huadi Zheng, PeiZhao Hu, Qingqing Ye, Haibo Hu).