Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2506.02456

VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents

Tri Cao·Bennett Lim·Yue Liu·Yuan Sui·Yuexin Li·Shumin Deng·Lin Lu·Nay Oo·Shuicheng Yan·Bryan Hooi
View original source ↗Read source document ↗Export metadata ↓

Abstract

Computer-Use Agents (CUAs) with full system access enable powerful task automation but pose significant security and privacy risks due to their ability to manipulate files, access user data, and execute arbitrary commands. While prior work has focused on browser-based agents and HTML-level attacks, the vulnerabilities of CUAs remain underexplored. In this paper, we investigate Visual Prompt Injection (VPI) attacks, where malicious instructions are visually embedded within rendered user interfaces, and examine their impact on both CUAs and Browser-Use Agents (BUAs). We propose VPI-Bench, a benchmark of 306 test cases across five widely used platforms, to evaluate agent robustness under VPI threats. Each test case is a variant of a web platform, designed to be interactive, deployed in a realistic environment, and containing a visually embedded malicious prompt. Our empirical study shows that current CUAs and BUAs can be deceived at rates of up to 51% and 100%, respectively, on certain platforms. The experimental results also indicate that system prompt defenses offer only limited improvements. These findings highlight the need for robust, context-aware defenses to ensure the safe deployment of multimodal AI agents in real-world environments. The code and dataset are available at: https://github.com/cua-framework/agents

Explore related subjects

cs.AIcs.CR

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Tri Cao, Bennett Lim, Yue Liu, Yuan Sui, Yuexin Li, Shumin Deng, Lin Lu, Nay Oo, Shuicheng Yan, Bryan Hooi. 2026-03-01. VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents. https://arxiv.org/abs/2506.02456

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

DeepFeature: LLM-Empowered Context-aware Feature Generation for Wearable Biosignals

Biosignals collected from wearable devices are widely utilized in healthcare applications. Machine learning models used in these applications often rely on features extracted from biosignals due to their effectiveness, lower data dimensionality, and wide compatibility across various model architectures. However, existing feature extraction methods often lack task-specific contextual knowledge, struggle to identify optimal features in high-dimensional combinatorial feature space, and are prone to automated code generation and execution errors. In this paper, we propose DeepFeature, the first LLM-empowered, context-aware feature generation framework for wearable biosignals. DeepFeature introduces a multi-source feature generation mechanism that integrates the inherent ability of LLMs, expert knowledge and inter-feature interactions. It also employs an iterative feature refinement process that uses feature assessment-based feedback for feature re-selection. Additionally, DeepFeature utilizes a robust multi-layer filtering and verification approach for feature description-to-code translation to ensure that the feature extraction functions run without crashing. Experimental evaluation results show that DeepFeature achieves the highest average AUROC across eight tasks under both sample-level and subject-level settings, outperforming the best baselines by 4.60% and 4.61%, respectively. DeepFeature achieves the most pronounced gains on the PPG-BP tasks, while remaining competitive with the best-performing baselines on Epilepsy, WESAD, and our self-collected SEN dataset.

cs.AI↗
arXiv2026

Modality-Guided Mixture of Structured Experts with Entropy-Triggered Routing for Multimodal Recommendation

Multimodal recommenders combine collaborative behavior with visual and textual item evidence, whose usefulness varies across user-item interactions. Independently trained source-specific diagnostic probes partition held-out interactions into behavior-, appearance-, semantics-, and mixed-evidence regimes across five benchmarks, within which capacity-matched fixed fusion rules exhibit systematic regime-dependent performance crossovers. This diagnostic observation motivates MAGNET, a multimodal graph recommender with two core mechanisms. First, a calibrated expert bank organizes trainable experts by anchor source (behavior, appearance, or semantics) and fusion family (dominant, balanced, or complementary), while an interaction-conditioned router selects a sparse composition using all three evidence sources. Second, an entropy-triggered, coverage-aware progressive schedule decouples population-level routing-mass coverage from per-instance decisiveness, transitioning from broad routing exploration to confident specialization once sufficient coverage is sustained, while preserving coverage thereafter. MAGNET separately encodes the observed interaction graph and a filtered content-induced structural view, applying cross-view alignment after independent propagation. We evaluate MAGNET on four Amazon domains and the non-Amazon MicroLens-100K benchmark, including tail-item and low-history warm-start user evaluation alongside matched expert-design controls. Under the shared-feature, fixed-split protocol, MAGNET-DV exceeds the strongest protocol-compatible non-MAGNET baseline in every reported main-table cell, supported by seed-wise difference tests. Both the fixed and KL-anchored structured variants achieve higher five-seed mean NDCG@20 than matched homogeneous and free-mixture alternatives across all five datasets. MAGNET supports route-level diagnostics through explicit expert semantics.

cs.AI↗
arXiv2026

From Refusal Tokens to Refusal Control: Discovering and Steering Category-Specific Refusal Directions

Language models are commonly fine-tuned for safety alignment to refuse harmful prompts. One approach fine-tunes them to generate categorical refusal tokens that distinguish different refusal types before responding. In this work, we leverage a version of Llama 3 8B fine-tuned with these categorical refusal tokens to enable inference-time control over fine-grained refusal behavior, improving both safety and reliability. We show that refusal token fine-tuning induces separable, category-aligned directions in the residual stream, which we extract and use to construct categorical steering vectors with a lightweight probe that determines whether to steer toward or away from refusal during inference. In addition, we introduce a learned low-rank combination that mixes these category directions in a whitened, orthonormal steering basis, resulting in a single controllable intervention under activation-space anisotropy, and show that this intervention is transferable across same-architecture model variants without additional training. Across benchmarks, both categorical steering vectors and the low-rank combination consistently reduce over-refusals on benign prompts while increasing refusal rates on harmful prompts, highlighting their utility for multi-category refusal control.

cs.AI↗