💬 NLP

VeriOS: Query-Driven Proactive Human-Agent-GUI Interaction for Trustworthy OS Agents

The paper introduces VeriOS, a query-driven framework and agent that enhances the trustworthiness of OS automation by proactively querying humans in untrustworthy scenarios, achieving a significant 19.72% improvement in step-wise success rates over baselines without compromising normal performance.

Original authors: Zheng Wu, Heyuan Huang, Xingyu Lou, Xiangmou Qu, Pengzhou Cheng, Zongru Wu, Weiwen Liu, Weinan Zhang, Jun Wang, Zhaoxiang Wang, Zhuosheng Zhang

Published 2026-04-06

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Zheng Wu, Heyuan Huang, Xingyu Lou, Xiangmou Qu, Pengzhou Cheng, Zongru Wu, Weiwen Liu, Weinan Zhang, Jun Wang, Zhaoxiang Wang, Zhuosheng Zhang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart, super-fast robot assistant that can look at your phone or computer screen and do things for you. It can click buttons, type messages, and open apps just by listening to your voice commands. This is what researchers call an OS Agent (Operating System Agent).

However, there's a big problem: This robot is too confident.

The Problem: The Over-Eager Robot

Imagine you tell your robot, "Send a text to Mom."

In a perfect world: The robot opens the messaging app, finds Mom, and sends the text. Easy!
In the real world: Suddenly, a pop-up appears asking, "Do you want to share your location?" or the app crashes, or your instruction was vague ("Send a text to someone").

A normal robot might panic or, worse, just guess. It might accidentally share your location with a stranger or send a text to the wrong person. This is called "over-execution." It does things it shouldn't because it doesn't know when to stop and ask for help.

Existing robots try to solve this by checking a "confidence score." If they aren't 100% sure, they just stop and wait. But this is like a student who stops working on a math problem just because they aren't sure of the answer, rather than asking the teacher for a hint. It's not very smart.

The Solution: VeriOS (The "Ask-First" Robot)

The paper introduces a new system called VeriOS. Think of VeriOS not as a robot that just does things, but as a smart partner that knows exactly when to say, "Hey, I need your help with this."

Here is how it works, using a simple analogy:

1. The "Detective" vs. The "Doer"

Most robots try to be both the detective (figuring out what's happening) and the doer (clicking the buttons) at the same time, often getting confused.

VeriOS breaks this down into two superpowers it learns separately, then combines them:

Superpower A (The Detective): "Is this a safe situation?" It looks at the screen and asks, "Is there a pop-up? Is the instruction vague? Is this a sensitive action?"
Superpower B (The Doer): "Okay, now that I know what's going on, what button do I click?"

2. The "Three-Stage Training" (The Schooling)

To teach VeriOS these skills, the researchers didn't just throw it into the deep end. They used a special three-step training method:

Step 1: The "Decoupling" (Separating the Skills): They took thousands of examples and split them. Some examples were just about identifying the problem (e.g., "This is a dangerous pop-up"). Others were about solving the problem (e.g., "Click 'Allow'").
Step 2: The "Interleaved" Practice (Mixing it up): Instead of teaching the robot "Detective skills" for a week and then "Doer skills" for a week, they mixed them up. They taught the robot to switch back and forth instantly. This helps the robot understand the connection between spotting a problem and solving it.
Step 3: The "Reward System" (The Report Card): They gave the robot a test. If it correctly identified a tricky situation and asked the human the right question, it got a gold star. If it guessed wrong or didn't ask when it should have, it got a red mark. Over time, it learned to be perfect at knowing when to ask.

How It Works in Real Life

Here is the new flow of interaction:

You say: "Book a flight to Paris."
VeriOS looks at the screen: It sees a pop-up asking for permission to access your contacts.
VeriOS (The Detective) speaks up: "Wait! This is a sensitive situation. I can't click 'Allow' without your permission. Do you want me to share your contacts?"
You say: "No, just cancel the pop-up."
VeriOS (The Doer) acts: It clicks "Cancel" and continues booking the flight.

If the screen was normal (no pop-ups), VeriOS would have just booked the flight instantly without bothering you.

Why Is This a Big Deal?

The researchers tested VeriOS against the best robots currently available.

The Result: VeriOS was 20% better at handling tricky, messy situations (like pop-ups or vague instructions) without making mistakes.
The Bonus: It didn't get slower or worse at simple tasks. It's like a driver who is great at racing on a track but also knows exactly when to slow down and ask for directions in a foggy city.

Summary

VeriOS is a new kind of computer assistant that has learned the most important lesson of all: It's okay to ask for help.

Instead of blindly guessing when things get messy, it proactively asks you, "Is this okay?" This makes it much safer and more trustworthy for real-world use, where computers crash, pop-ups appear, and instructions aren't always clear. It's the difference between a robot that crashes your car because it didn't see a stop sign, and a robot that gently taps your shoulder and says, "Hey, I think we need to stop here."

1. Problem Statement

With the advancement of Multimodal Large Language Models (MLLMs), Operating System (OS) agents have become capable of automating tasks via Graphical User Interfaces (GUIs). However, current OS agents are primarily designed for idealized, trustworthy environments. In real-world scenarios, agents face untrustworthy conditions that lead to "over-execution" (performing actions without sufficient context or safety checks), resulting in errors or security risks.

These untrustworthy conditions stem from two sources:

Environment-side: OS instability (crashes, pop-ups, disconnections) and sensitive actions (e.g., triggering location permission requests).
User-side: Ambiguous instructions and situations requiring multiple plausible choices.

Existing solutions, such as confidence-driven interaction (stopping when confidence is low), lack interpretability and often fail to distinguish between different types of untrustworthy scenarios. There is a critical need for an agent that can proactively identify untrustworthy scenarios, query the human user for clarification, and leverage the response to complete the task safely, all without sacrificing performance in normal scenarios.

2. Methodology

The authors propose VeriOS, a framework comprising a new benchmark, a learning paradigm, and an agent architecture.

A. VeriOS-Bench (Benchmark)

To evaluate and train agents in these specific conditions, the authors constructed VeriOS-Bench, a cross-platform benchmark covering mobile, desktop, web, and tablet environments.

Data Composition: Contains 622 screenshots of both normal and untrustworthy scenarios (ratio ~6:4).
Annotations: Includes ground truth actions, scenario types, and crucially, query-answer pairs (what the agent should ask and the expected human response) for untrustworthy scenarios.
Scenario Types:
1. Environment Anomalies (EA): OS crashes, pop-ups.
2. Sensitive Actions (SA): Actions requiring permission (e.g., location).
3. Information Missing (IM): Ambiguous user instructions.
4. Multiple Choices (MC): Situations with multiple valid paths.
5. Normal Scenarios (NS): Standard tasks.

B. Meta-Knowledge Decoupling

The core innovation is the decoupling of "meta-knowledge" within the training data. Each data instance $d$ is split into two derived sub-instances to isolate specific learning objectives:

Scenario Knowledge ( $K_{scenario}$ ): Input: (Prompt, Instruction, Screenshot) $\rightarrow$ Output: (Scenario Type, Query). This teaches the agent when to ask and what to ask.
Action Knowledge ( $K_{action}$ ): Input: (Prompt, Instruction, Screenshot, Query, Human Answer) $\rightarrow$ Output: (Scenario Type, Ground Truth Action). This teaches the agent how to act based on the interaction history.

C. Three-Stage Learning Paradigm

VeriOS-Agent is trained using a specific three-stage process to integrate these knowledge types:

Interleaved Supervised Fine-Tuning (SFT): The training dataset is constructed by interleaving $d_1$ (Scenario Knowledge) and $d_2$ (Action Knowledge) from the same original instance. This allows the model to learn the logical connection between identifying a problem, asking a question, and executing the solution.
Group Relative Policy Optimization (GRPO): A reinforcement learning stage using a rule-based reward system to refine the policy.
- Scenario Reward: Rewards correct identification of the scenario type and generation of the correct query.
- Action Reward: Rewards the correctness of the action type and parameters.
- Objective: Maximizes the relative advantage of high-reward samples within a group while maintaining alignment with the reference model.

D. Interaction Workflow

Normal Scenarios: The agent autonomously executes GUI actions.
Untrustworthy Scenarios: The agent detects the anomaly, generates a specific query (e.g., "Which app should I open?"), waits for the human response, and then executes the final action based on the combined context.

3. Key Contributions

Query-Driven Interaction Framework: A novel paradigm where OS agents proactively query humans in untrustworthy scenarios rather than blindly executing or simply deferring. This ensures interpretability and safety.
Three-Stage Learning Paradigm: A method using SFT and GRPO to decouple and re-integrate scenario judgment and action execution knowledge, preventing catastrophic forgetting and improving generalization.
VeriOS-Bench: The first cross-platform benchmark specifically annotated for untrustworthy scenarios and human-agent query-answer pairs.
VeriOS-Agent: A trustworthy OS agent that outperforms existing baselines in both untrustworthy and normal scenarios.

4. Experimental Results

The authors evaluated VeriOS-Agent against 13 baselines (including UI-TARS, Qwen-VL, GPT-4o, and specialized OS agents) on VeriOS-Bench.

Performance in Untrustworthy Scenarios: VeriOS-Agent achieved a 20.64% average improvement in step-wise success rate compared to the strongest baseline in untrustworthy scenarios.
- Example: In "Information Missing" (IM) scenarios, VeriOS-Agent-32B achieved 71.43% success, whereas the best baseline (Qwen2.5-VL-72B) only achieved 21.43%.
Performance in Normal Scenarios: Crucially, VeriOS-Agent maintained comparable performance to baselines in normal scenarios (NS), showing no degradation in standard task execution.
Scenario Judgment Accuracy (SJA): VeriOS-Agent improved scenario identification accuracy to 80.21%, significantly higher than existing agents (which ranged from 46.52% to 60.96%).
Ablation Studies:
- Interleaved Training: Proven superior to shuffled, rotating, or phased training, as it preserves the logical link between asking and acting.
- Single vs. Dual Agent: A single agent trained with decoupled knowledge outperformed a dual-agent system (one for judgment, one for action), likely due to implicit learning of logical connections and lower computational overhead.
- Base Model: General-purpose models (Qwen2.5-VL) outperformed specialized OS agents (GUI-Owl) as base models, suggesting general language understanding is vital for query generation.
- Scalability & OOD: The agent demonstrated strong generalization to Out-of-Distribution (OOD) scenarios and scalability when trained on subsets of data, mitigating catastrophic forgetting.

5. Significance

This work addresses a critical gap in the deployment of autonomous AI agents: trustworthiness in non-ideal environments. By shifting from a purely autonomous model to a query-driven human-in-the-loop approach, VeriOS-Agent significantly reduces the risk of over-execution and errors in real-world OS interactions.

The proposed meta-knowledge decoupling and interleaved training strategy offer a generalizable framework for training agents that must balance autonomy with safety. The introduction of VeriOS-Bench provides a necessary standard for future research into robust, trustworthy OS agents, moving the field beyond idealized testing environments.