AgentRAE: Remote Action Execution through Notification-based Visual Backdoors against Screenshots-based Mobile GUI Agents

1. Problem Statement

The rapid adoption of mobile Graphical User Interface (GUI) agents, which autonomously control applications and operating systems based on screenshots and Multimodal Large Language Models (MLLMs), has introduced new security vulnerabilities.

• Limitations of Existing Attacks: Traditional backdoor attacks against web agents or general GenAI models rely on environmental injection (modifying UI elements) or deceptive pop-ups. These fail on mobile GUI agents because modern mobile OSs restrict interface manipulation (sandboxing) and make suspicious visual patterns easily detectable.
• The Challenge: The authors identify a critical gap: how to inject a backdoor into a mobile GUI agent that relies on screenshots for perception, using visually benign triggers that are small, constrained by OS styles, and easily overwhelmed by the surrounding screen context.
• Specific Technical Hurdles:
  1. OS Constraints: Native notification icons are small and visually similar, offering limited space for embedding robust trigger signals.
  2. Attention Failure: The agent's visual attention is dominated by the main screen interface, causing it to ignore small notification icons (the "small trigger" problem).
  3. Multi-Target Mapping: The attack requires mapping multiple distinct icons (triggers) to specific, different actions (e.g., Icon A $\to$ Click, Icon B $\to$ Type). Standard backdoor methods struggle with this "one-to-many" mapping conflict where visually similar inputs must yield divergent outputs.

2. Methodology: AgentRAE

The authors propose AgentRAE, a novel backdoor framework that uses native app icons in mobile notifications as triggers to induce Remote Action Execution. The core innovation is a two-stage training pipeline designed to decouple trigger representation from action mapping.

A. Attack Vector

• Trigger: Benign-looking app icons within system notifications (e.g., TikTok, Discord, WeChat).
• Delivery: The attacker compromises the MLLM model (supply chain poisoning) or distributes a backdoored model. When the agent receives a notification containing a specific icon, the model ignores the user's original intent and executes a pre-defined malicious action (e.g., clicking a phishing link, typing credentials, or navigating to a malicious URL).
• Stealth: The triggers are native OS elements, making them indistinguishable from legitimate notifications to both users and standard security filters.

B. Two-Phase Training Pipeline

To overcome the technical challenges, AgentRAE employs a sequential training strategy:

1. Phase 1: Supervised Contrastive Learning (Trigger Separation)

   • Goal: To force the model to distinguish between visually similar notification icons at a deep semantic level.
   • Mechanism: Uses a Trigger-Separation Loss (based on InfoNCE). It clusters representations of samples with the same trigger icon while pushing apart representations of samples with different trigger icons.
   • Technique: Aggregates hidden states across layers via average pooling to create unified sample-level representations. This ensures the model learns that "TikTok icon" and "Discord icon" are distinct features, even if they appear in the same notification frame.

2. Phase 2: Supervised Poisoning Training (Action Mapping)

   • Goal: To map the now-separated trigger representations to specific malicious actions without degrading the agent's normal performance.
   • Mechanism: Uses a Balanced Poison Loss. This combines the loss from clean data (to preserve utility) and poisoned data (to inject the backdoor).
   • Strategy: The model is fine-tuned on a mix of clean tasks and poisoned tasks where specific icons trigger specific actions (e.g., "If Discord icon is present, execute CLICK"). The separation achieved in Phase 1 allows the model to learn these mappings without the "conflicting signals" that usually cause failure in multi-target attacks.

3. Key Contributions

1. Novel Attack Surface: First demonstration of a backdoor vulnerability in mobile GUI agents exploiting native OS notifications. This shifts the attack surface from the interface layer to the perception-decision layer.
2. Robust Learning Framework: Introduction of the two-phase pipeline (Contrastive Learning + Poisoning) that solves the "attention failure" and "multi-target mapping" problems inherent in small, visually similar triggers.
3. High Performance & Stealth: The attack achieves high success rates while maintaining the agent's ability to perform normal tasks, making it difficult to detect via performance degradation.
4. Defense Evaluation: Comprehensive analysis showing that state-of-the-art defenses (Fine-Pruning, Neural Attention Distillation) are ineffective against this specific type of multi-target, open-ended action backdoor.

4. Experimental Results

The authors evaluated AgentRAE on two representative mobile GUI agents (OdysseyAgent and SeeClic-aitw) using datasets like GUIOdyssey and AITW.

• Attack Success Rate (ASR):
  • Achieved an average ASR of >90% across ten different mobile operations (CLICK, TYPE, HOME, etc.) and multiple triggers.
  • In a 9-target scenario, ASR reached 99.58% on SeeClic-aitw and 89.25% on OdysseyAgent.
  • Outperformed baselines (Scenario-BadNets, AEIA, Pop-ups) by a significant margin (e.g., +13% to +55% improvement over BadNets).
• Clean Task Performance:
  • The attack caused minimal degradation in normal task performance. Action Matching Score (AMS) dropped by only 0.14% to 3.63% depending on the dataset split, and Success Rate (SR) remained largely stable.
• Generalization:
  • Resolution Robustness: The backdoor remained effective (ASR >87%) even when tested on screen resolutions different from the training resolution (e.g., training on 1080x2400, testing on 720x1280).
  • Data Efficiency: High success rates were achieved with only 2,000 poisoned samples per trigger.
• Defense Evasion:
  • Existing defenses like Fine-Pruning and NAD failed to reduce the ASR significantly (ASR remained >88% after defense).
  • Defenses relying on fixed-label enumeration are inapplicable because mobile agents generate open-ended action sequences.

5. Significance and Implications

• Supply Chain Risk: The paper highlights a critical risk in the AI supply chain. A single compromised MLLM model distributed via public repositories (e.g., Hugging Face) can silently hijack the behavior of thousands of downstream mobile agents.
• Limitations of Current Defenses: The study exposes a fundamental mismatch between current backdoor defenses (designed for static classification) and dynamic agent behaviors (open-ended action sequences).
• Call to Action: The authors argue that security for autonomous agents must move beyond surface-level input filtering. Future defenses must scrutinize notification-conditioned behaviors and internal agent representations to detect subtle, persistent policy shifts caused by backdoors.
• Real-World Impact: Attackers can leverage leaked personal data (phone numbers/emails) to target specific users, sending benign-looking notifications that trigger complex malicious chains (e.g., phishing, data exfiltration) without ever compromising the user's device OS directly.

In conclusion, AgentRAE demonstrates that mobile GUI agents are highly vulnerable to sophisticated, multi-target visual backdoors that exploit the very mechanisms (notifications) intended for user interaction, necessitating a re-evaluation of AI safety protocols for autonomous agents.