DIBench Evaluates Decision Integrity of Mobile GUI Agents Under Deceptive Prompt Injection Attacks
A new benchmark called DIBench measures how malicious, deceptive UI inputs affect the decision-making integrity of multimodal mobile agents. Tests across 14 major models reveal significant degradation in task completion rates when visual or structural deception is introduced.
A research paper introducing DIBench has been published on arXiv, establishing a novel benchmark to evaluate the decision integrity of GUI-based mobile agents. The framework quantifies how easily mobile agents executing user instructions can be manipulated by deceptive prompt injection attacks embedded directly into user interfaces. This study addresses a critical security gap in dynamic mobile environments where structural and visual UI elements can be leveraged to compromise an agent's decision-making process.
Primary source
Open arXiv ↗This article summarizes the source. Check the original for full details and conditions.
Comparison
| Aspect | Before / Alternative | After / This |
|---|---|---|
| Attack Surface | Text-only prompt injections in chat interfaces | Deceptive visual and structural elements in mobile GUIs |
| Evaluation Environment | Static text or simulated web environments | Dynamic Android-based OS execution environments |
| Threat Model | Direct instruction overrides from the user | Indirect injections from untrusted third-party UI content |
| Evaluation Scope | Single-turn text classification and responses | Multi-step actions including transactions and data transfers |
Action Checklist
- Review the DIBench paper on arXiv to understand the specific UI injection vectors evaluated. Pay attention to how multimodal models interpret visual versus structural deception.
- Incorporate GUI layout validation and sanitization in mobile agent development pipelines. Do not rely solely on the underlying LLM to filter out deceptive UI content.
- Deploy execution-environment filters to monitor and intercept unauthorized high-risk actions. High-risk actions include processing payments or sending sensitive system data.
- Benchmark current multimodal models like GPT-4o and Claude 3.5 Sonnet against visual injection patterns. Success rates under attack can drop significantly compared to baseline scenarios.
