VisualTrap：通过视觉定位操纵对GUI智能体的隐蔽后门攻击
VisualTrap: A Stealthy Backdoor Attack on GUI Agents via Visual Grounding Manipulation
AI总结：
针对GUI智能体的视觉定位漏洞，提出VisualTrap后门攻击方法，通过少量中毒数据隐蔽劫持定位，且攻击可泛化至下游任务和不同环境。
摘要：
由大型视觉语言模型（LVLMs）驱动的图形用户界面（GUI）智能体已成为自动化人机交互的革命性方法，能够自主操作个人设备（如手机）或设备内的应用程序，以类人方式执行复杂的现实世界任务。然而，它们与个人设备的紧密集成引发了重大的安全问题，许多威胁（包括后门攻击）在很大程度上仍未得到探索。这项工作揭示了GUI智能体的视觉定位——将文本计划映射到GUI元素——可能引入漏洞，从而催生新型后门攻击。通过针对视觉定位的后门攻击，即使智能体获得正确的任务解决计划，其行为也可能被破坏。为验证这一漏洞，我们提出了VisualTrap，一种通过误导智能体将文本计划定位到触发位置而非预期目标来劫持定位的方法。VisualTrap采用常见的注入中毒数据进行攻击，并在视觉定位的预训练阶段进行，以确保攻击的实际可行性。实验结果表明，VisualTrap仅需5%的中毒数据和高度隐蔽的视觉触发器（人眼不可见）即可有效劫持视觉定位；且该攻击可泛化到下游任务，即使在干净微调后依然有效。此外，注入的触发器在不同GUI环境中保持有效，例如在移动端/网页端训练后可泛化到桌面环境。这些发现凸显了进一步研究GUI智能体中后门攻击风险的紧迫性。
英文摘要：
Graphical User Interface (GUI) agents powered by Large Vision-Language Models (LVLMs) have emerged as a revolutionary approach to automating human-machine interactions, capable of autonomously operating personal devices (e.g., mobile phones) or applications within the device to perform complex real-world tasks in a human-like manner. However, their close integration with personal devices raises significant security concerns, with many threats, including backdoor attacks, remaining largely unexplored. This work reveals that the visual grounding of GUI agent-mapping textual plans to GUI elements-can introduce vulnerabilities, enabling new types of backdoor attacks. With backdoor attack targeting visual grounding, the agent's behavior can be compromised even when given correct task-solving plans. To validate this vulnerability, we propose VisualTrap, a method that can hijack the grounding by misleading the agent to locate textual plans to trigger locations instead of the intended targets. VisualTrap uses the common method of injecting poisoned data for attacks, and does so during the pre-training of visual grounding to ensure practical feasibility of attacking. Empirical results show that VisualTrap can effectively hijack visual grounding with as little as 5% poisoned data and highly stealthy visual triggers (invisible to the human eye); and the attack can be generalized to downstream tasks, even after clean fine-tuning. Moreover, the injected trigger can remain effective across different GUI environments, e.g., being trained on mobile/web and generalizing to desktop environments. These findings underscore the urgent need for further research on backdoor attack risks in GUI agents.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
