LaSM: Layer-wise Scaling Mechanism for Defending Pop-up Attack on GUI Agents

1. Problem Statement

Context: Graphical User Interface (GUI) agents, powered by Multimodal Large Language Models (MLLMs), are increasingly capable of performing complex screen-based tasks (e.g., web browsing, shopping).
Vulnerability: These agents are highly susceptible to environmental injection attacks, specifically pop-up windows. Malicious actors can render pop-ups that divert the agent's attention, causing it to execute unsafe or incorrect actions (e.g., clicking "Confirm" on a malicious dialog instead of closing it).
Limitations of Existing Defenses:

• Retraining-based methods (e.g., DPO): Require massive data collection and computational resources, creating high deployment barriers.
• Prompt-level alerts (e.g., Chain-of-Thought): Often fail against "inductive" pop-ups where the malicious text is semantically aligned with the user's original request.
• Black-box nature: Existing methods do not explain the internal mechanism of the vulnerability, limiting their generalizability.

2. Methodology: LaSM (Layer-wise Scaling Mechanism)

The authors propose LaSM, a post-training, plug-and-play defense that requires no retraining. It operates by selectively rescaling specific internal modules of the MLLM to restore attention alignment.

A. Core Insight: Layer-wise Attention Divergence

Through systematic analysis of MLLM attention maps (using Qwen2-VL-7B as a case study), the authors discovered a distinct pattern:

• Shallow Layers: Attention patterns are stable and indistinct regardless of whether the model outputs a correct or incorrect answer.
• Deep Layers (Decision-Critical): A significant divergence emerges in mid-to-deep layers (specifically Layers 21–26 in the studied model). In these layers, the attention maps for correct outputs (e.g., clicking <icon-cross>) and incorrect outputs (e.g., clicking <button-confirm>) differ substantially.
• Hypothesis: Pop-up attacks disrupt the model's ability to focus on task-relevant regions in these critical layers.

B. The Mechanism

LaSM intervenes by amplifying the Attention and MLP (Multi-Layer Perceptron) modules within a specific, narrow range of layers.

1. Progressive Range Narrowing: The method automatically identifies the optimal layer range (e.g., Layers 7–18 for Qwen2-VL-7B) where scaling yields the highest defense success rate.
2. Joint Scaling: It applies a scaling factor $\alpha$ to the weights of both the Attention sub-layer and the MLP sub-layer within the selected range.
   • Formula: $X^{(l+1)} = X^{(l)} + \alpha \cdot \text{Attention}^{(l)}(\text{Norm}(X^{(l)})) + \alpha \cdot \text{MLP}^{(l)}(\text{Norm}(X'))$
   • Crucial Finding: Scaling only Attention or only MLP fails. Both must be scaled jointly to maintain the internal representation flow and prevent semantic degradation.
3. Optimal Coefficient ($\alpha$): The scaling factor is model-specific but generally falls in a narrow range near $\alpha \approx 1.1$. Values too far from 1.0 cause hallucinations or semantic loss.

3. Key Contributions

1. Systematic Vulnerability Analysis: The first study to reveal that pop-up attacks cause layer-wise attention divergence in GUI agents, identifying mid-level semantic layers as the safety-critical bottleneck.
2. LaSM Defense: A lightweight, training-free, and backbone-agnostic mechanism that selectively amplifies attention and MLP modules to realign model saliency with task-relevant regions.
3. Comprehensive Evaluation: Validated across multiple models (Qwen2-VL, LLaVA, OS-Atlas, LLaMA) and datasets (2,400 perturbed screenshots covering 12 pop-up styles).
4. Real-World Applicability: Demonstrated effectiveness in multi-step Android control tasks, proving that the defense works in complex, sequential interaction scenarios without degrading normal performance.

4. Experimental Results

The paper evaluates LaSM on two primary models: Qwen2-VL-7B and LLaVA-v1.6-Vicuna-13B.

• Defense Success Rate (DSR):
  • Qwen2-VL-7B: LaSM alone raised the average DSR from ~18.9% (No Defense) to 66.4% (Overlay) and 68.3% (Inductive). When combined with CoT alerts, it reached 99.3%.
  • LLaVA-v1.6-Vicuna-13B: LaSM alone achieved 100% DSR across all settings.
• Multi-Step Robustness (AndroidControl):
  • In full-episode benchmarks, LaSM increased the Task Success Rate (TSR) from 18.75% to 30.36% (a 61.92% relative improvement).
  • Crucially, this improvement came with negligible impact on normal task performance (Type accuracy, Grounding, and Step Success Rate remained stable).
• Generalization: The method successfully transferred to other backbones (OS-Atlas-Pro-7B, LLaMA-3.2-11B), confirming its model-agnostic nature.
• Ablation Studies:
  • Scaling only Attention or only MLP resulted in near-zero defense success, proving the necessity of joint scaling.
  • Scaling high-level layers (e.g., >26) degraded performance, confirming that mid-level layers are the optimal target.

5. Significance and Conclusion

• Paradigm Shift: LaSM moves GUI agent security away from expensive retraining or brittle prompt engineering toward internal architectural modulation.
• Efficiency: As a plug-and-play module, it can be deployed instantly on existing models without data collection or fine-tuning.
• Mechanism Clarity: The work provides a theoretical explanation for GUI agent vulnerabilities (attention misalignment in specific layers) and offers a precise, interpretable solution.
• Practical Impact: By significantly boosting robustness against both "overlay" (obvious) and "inductive" (subtle) attacks, LaSM makes MLLM-based GUI agents safer for real-world deployment in sensitive environments like mobile automation and web browsing.

Code Availability: The implementation is open-source at https://github.com/YANGTUOMAO/LaSM.