Alignment Is Local: A Paired Diagnostic for GUI Agents under User-Side Persuasion
TL;DR
It is shown that a one-line guardrail achieves large single-shot ASR reductions, up to roughly 40 points, at near-zero over-refusal cost, which overstates deployed robustness by a systematic and predictable margin.
Abstract
Trustworthy deployment of GUI agents in ubiquitous computing settings requires alignment that survives dynamic interaction and precise threat conditions, not just single-turn refusal of explicit harmful requests. We argue that prompt-level alignment, the dominant lightweight defense in current mobile agents, is a local phenomenon: it works reliably only in the narrow evaluation slice where it is typically measured, namely single-turn, explicitly-verbalized intent, and degrades systematically along two axes that any real user can traverse. Using a paired diagnostic on three frontier GUI agents, screen-grounded, user-side persuasion, with no environment injection, we show that a one-line guardrail achieves large single-shot ASR reductions, up to roughly 40 points, at near-zero over-refusal cost. Nevertheless, moving from independent probes to four-turn escalation chains raises guarded ASR by approximately 20 points on every model. Relative to the neutral baselines, this increase reflects substantial guardrail erosion for Qwen but a largely defense-orthogonal dynamic risk for Claude and GPT. The sign of the salience gap flips under the guardrail: concealed requests are not systematically more successful than explicit ones without a guardrail, but are more successful with one, indicating that the defense engages primarily when intent is named. Static single-turn ASR therefore overstates deployed robustness by a systematic and predictable margin.