ai-research-survey

scan.json (35171B)

---

 {
   "paper": {
     "title": "EVA: Red-Teaming GUI Agents via Evolving Indirect Prompt Injection",
     "authors": [
       "Yijie Lu",
       "Tianjie Ju",
       "Manman Zhao",
       "Xinbei Ma",
       "Yuan Guo",
       "Zhuosheng Zhang"
     ],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2505.14289",
     "doi": "10.48550/arXiv.2505.14289"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "EVA, a feedback-driven red-teaming framework for GUI agents, outperforms static injection baselines by up to +32% attack success rate (ASR) in pop-up scenarios and +26% in chat scenarios across six multimodal agents. The framework discovers transferable attack patterns, with prompts evolved on one model achieving up to +46% ASR improvement on unseen target models. High-risk scenarios (payment, email) prove largely resistant to injection, with 0% success for payment across all models. Persuasive (49.8%) and urgency (40.0%) strategies dominate successful attacks, with model-specific susceptibility patterns.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims in contributions section: 'We build and release a reproducible evaluation pipeline' but provides no repository URL, GitHub link, or archive. No working code link appears anywhere in the paper."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "No dataset of attack samples, agent responses, or scenario environments is released. The injection scenarios are custom-created and described in text/figures but not provided as downloadable artifacts."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Table 6 lists generation hyperparameters (temperature, top_p, top_k, max_tokens) but no environment specifications such as requirements.txt, Docker configuration, library versions, or hardware setup are provided."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided. While the methodology is described in Section 3 and prompt templates are given in Appendix B, there are no concrete instructions for replicating the full experimental pipeline."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Tables 2-4 and Table 7 report only point estimates (percentages) with no confidence intervals, error bars, or uncertainty measures. All results are single-value success/failure/invalid rates from 50 samples."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims EVA 'outperforms' and 'consistently improves' over baselines throughout, but no statistical significance tests (t-tests, chi-squared, bootstrap, etc.) are applied to any comparison. All claims rest on raw percentage differences."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Tables 2 and 4 report both baseline and EVA success rates with explicit delta improvements (e.g., '48 → 80 (+32)'), providing sufficient context to assess the magnitude of improvement relative to baseline performance."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses 50 samples per agent per scenario (Section 4.1: 'we generate 50 samples per agent per scenario') but provides no justification for why 50 was chosen. No power analysis or sample size rationale is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported across any results. Each condition shows a single success/failure/invalid split from 50 trials with no indication of variability across runs or seeds."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "A static baseline is defined in Section 4.1: one-shot injections generated by GLM-4v-Plus using fixed prompt templates, evaluated as-is without iterative refinement. EVA is compared against this baseline across all agents and scenarios."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "The baseline is the authors' own creation (static GLM-4v-Plus generations) rather than a published prior method. Despite citing existing attack methods like AdvWeb [31], Zhan et al. [10], and WASP [11], none are included as experimental comparisons."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Table 7 (Appendix D) presents a goal-prompt ablation comparing 'w/ Goal' vs 'w/o Goal' variants across all six models, showing that goal information boosts ASR by 2-24 percentage points."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "The primary evaluation metric is ASR (attack success rate). While outcomes are categorized as success/failure/invalid, these are components of a single outcome classification, not independent metrics. No alternative metrics (e.g., attack stealth, detection difficulty, time to succeed) are reported."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "Attack success is judged entirely by automated classification using the LLM-based Action Evaluation Prompt (Appendix B.5). No human evaluation of attack quality, realism, or stealth is conducted."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "EVA's optimization and evaluation occur on the same models and scenarios. The main results in Table 2 reflect the final performance of the evolved attacks on the same target model used for optimization. Only the transferability experiments (Table 4) test on unseen targets."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by model (6 agents), scenario (pop-up, chat link, payment, email) in Tables 2-3, by source-target model pair for transferability (Table 4), and by persuasion strategy across scenarios and models (Table 5, Figures 7-9)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 shows 0% success for payment scenarios across all models. Section 4.2 discusses why: 'agents either ignore or explicitly reject the injected content, suggesting that these high-risk contexts are inherently more resistant.' The paper also discusses models with high invalid rates (GPT-4V, UI-TARS-7B-DPO at 50%+ invalid in payment)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 reports complete failure of attacks in payment scenarios (0% success for all models). Table 4 shows some negative transfer cases (e.g., GPT-4o source → GLM-4v-Plus target: EVA 38 vs baseline 40, Δ=-2). The goal ablation (Table 7) shows significantly reduced ASR without goal information."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims EVA 'substantially improves success rates over static baselines' (supported by Tables 2-4), 'far greater transferability' (Table 4), effective under 'goal-agnostic constraints' (Table 7, though weaker), and 'injection styles transfer well across models' (Table 4). All claims have corresponding experimental evidence."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper claims EVA's feedback-driven evolution causes higher attack success than static methods. The experimental design compares EVA against the static baseline with all other variables controlled (same scenarios, same target models, same sample size), supporting causal attribution. The ablation study (Table 7) further isolates the goal component."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title 'Red-Teaming GUI Agents' and claims about 'common vulnerabilities in multimodal decision-making' extend well beyond the six tested agents in four synthetic scenarios. The paper does not bound generalization to the specific agents, scenario types, or synthetic environment used. Real-world GUI environments with dynamic content and user interaction are not tested."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not consider alternative explanations for EVA's success. For instance, the improvement could be partly due to the static baseline being deliberately weak (their own creation), or the automated evaluation prompt (Appendix B.5) may systematically favor EVA's evolved outputs. No robustness checks against confounds are discussed."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper measures ASR (clicking injected elements in synthetic scenarios) and frames this as revealing 'vulnerabilities' and 'failure modes' in multimodal decision-making. The gap between clicking a button in a controlled DOM injection and real-world agent vulnerability is not acknowledged. No discussion of whether synthetic ASR translates to real-world security risk."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are listed as 'GLM-4v-Plus', 'GPT-4V', 'GPT-4o', 'Qwen2.5-VL', 'UI-TARS-7B-DPO', and 'OS-Atlas-base'. No snapshot dates, API versions, or specific model IDs are provided. Per the schema, marketing names like 'GPT-4o' without a snapshot date do not count as specified versions."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt templates with actual text are provided in Appendix B: agree button generation (B.2), reject button rewriting (B.2), common steps extraction (B.2), popup confusion generation (B.3), action summarization (B.4), action evaluation (B.5), and attack-type classification (B.6)."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 6 reports all experimental hyperparameters: temperature (0.7), top_p (1.0), top_k (32), max_tokens (512), max_iter_steps (10), num_evals (10), success_threshold (7). Section B.7 provides explanations for each."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "EVA's pipeline is described in detail in Section 3.3 with Figure 3: keyword lexicon initialization, injection construction via weighted sampling, feedback-driven lexicon update (Equation 5), pruning and regeneration at fixed intervals, and termination criteria. The feedback loop mechanism is fully specified."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The initial keyword lexicon is described only as 'seeded from a combination of curated trigger words (e.g., \"urgent,\" \"confirm,\" \"security\") and LLM-generated distractors' without providing the full initial set. The extraction function S(T(Kt)) is described as isolating tokens 'based on syntactic roles or heuristic salience' without specifying the heuristics. Key preprocessing parameters (pruning δ%, base increment b, bonus B) are not given exact values."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A contains a dedicated 'Limitations' section discussing EVA's nature as a behaviour-driven probe, lack of access to deeper perceptual mechanisms, inability to explain why injections succeed, and operation in synthetic environments."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations section raises study-specific concerns: EVA 'has no access to the deeper perceptual or grounding mechanisms,' 'cannot explain *why* certain injections succeed beyond statistical associations,' and 'ignores the messy co-evolution found in real interfaces, where user intent, agent alignment and environmental distractions interact.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "While limitations are discussed, the paper does not explicitly state what the results do NOT show. It does not specify which populations, agent types, or real-world scenarios are excluded from claims. The limitations section describes what EVA cannot do but doesn't frame explicit boundaries on the generalizability of the findings."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw data is available: no attack samples, agent responses, evolved keyword lexicons, or per-trial outcome logs are released. Only aggregated percentages appear in the tables."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes the experimental procedure: 50 samples per agent per scenario, four injection scenarios, six target agents. The static baseline generation process (GLM-4v-Plus, temperature 0.7, 50 independent calls) and EVA's iterative optimization loop are described in Sections 3.3 and 4.1."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": false,
         "justification": "The six GUI agents are described as 'widely used generalist and specialist GUI agents' but no selection criteria or justification for choosing these specific six models is provided. The four scenarios are stated to 'reflect typical use cases' without systematic derivation."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "While the high-level pipeline (inject → render → feed to agent → classify → compute ASR) is clear, key specifics are missing: the exact pruning percentage δ for lexicon evolution, the values of base increment b and bonus B in Equation 5, convergence criteria, and how the automated action evaluation prompt's output maps to final ASR counts."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding acknowledgment, grant numbers, or sponsor information appears anywhere in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Wuhan University and Shanghai Jiao Tong University. These are academic institutions not affiliated with the evaluated commercial products (GLM, GPT, Qwen)."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Since funding is not disclosed, independence of the funder cannot be assessed. The absence of a funding statement does not confirm unfunded status."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement, patent disclosures, or financial interest declarations appear in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This is a red-teaming study that tests attack effectiveness against GUI agents, not a study evaluating model knowledge or capability on a benchmark. Contamination criteria do not apply."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Red-teaming study testing attack methods against models, not evaluating pre-trained model capability on a benchmark."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Red-teaming study testing attack methods against models, not evaluating pre-trained model capability on a benchmark."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. All experiments are conducted with AI agents responding to injected GUI content."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No API costs, token consumption, or per-trial costs are reported despite using multiple commercial APIs (GPT-4V, GPT-4o, GLM-4v-Plus) across 50 samples × 6 agents × 4 scenarios plus iterative EVA optimization loops."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, API spend, wall-clock time, or hardware specifications are reported. The iterative optimization in EVA (up to 10 iterations per sample with 10 evaluations each) implies significant compute but this is not quantified."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds or seed sensitivity analysis. The stochastic elements (LLM generation with temperature 0.7, keyword sampling) could produce different results across seeds, but this is not investigated."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 explicitly states '50 samples per agent per scenario' for the baseline, and the EVA optimization parameters include 'num_evals: 10' per popup and 'max_iter_steps: 10' (Table 6)."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "The hyperparameters in Table 6 appear fixed without any search. No mention of how these values (e.g., temperature 0.7, success_threshold 7, max_iter_steps 10) were selected or how many configurations were explored."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "Only one configuration is reported with no explanation of how the hyperparameters in Table 6 were chosen. No validation set or selection criterion is described for choosing the final parameter values."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes comparisons across 6 models × 4 scenarios × 2 methods but applies no statistical tests at all, let alone corrections for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors compare EVA (their system) against a static baseline they created themselves. No acknowledgment of author-evaluation bias. No independent evaluation or third-party reproduction is mentioned."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "EVA uses iterative optimization (up to 10 iterations × 10 evaluations) while the static baseline generates samples in a single pass. This significant compute difference is never discussed or controlled for. It is unclear whether the improvement comes from the adaptive algorithm or simply from having more compute budget."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether ASR on synthetic DOM-injected scenarios actually measures real-world GUI agent vulnerability. No analysis of whether these controlled scenarios represent the full attack surface or whether ASR correlates with real-world security risk."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The six agents have different architectures and internal scaffolding (generalist vs specialist, different visual grounding methods). When comparing vulnerability across agents, these differences are confounded with underlying model differences. The paper does not control for or discuss this confound."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The models may have been trained on similar attack patterns or defensive strategies from prior work. No discussion of whether the tested models' training data includes indirect prompt injection examples or defenses that could affect results."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The evaluation setup feeds the full rendered screenshot to agents. No discussion of whether the visual rendering process leaks information about what constitutes an injection (e.g., positioning, styling cues) that would not be present in real-world attacks."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The 50 static baseline samples are generated independently, but EVA's evolved samples within a single optimization run are correlated (each iteration builds on prior successes). This non-independence is not discussed and could inflate apparent ASR improvements."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are applied. No analysis of whether models have been specifically trained to resist these injection patterns."
       }
     }
   },
   "claims": [
     {
       "claim": "EVA consistently outperforms static baselines in attack success rate across all agents and scenarios, with up to +32% improvement in pop-up scenarios.",
       "evidence": "Tables 2-3 show EVA vs baseline results across 6 models and 4 scenarios. In pop-up scenarios, EVA achieves +32% on GLM-4v-Plus (48→80%), +26% on OS-Atlas-Base (20→46%). In chat scenarios, up to +26% on GPT-4V (16→42%).",
       "supported": "moderate"
     },
     {
       "claim": "EVA-evolved prompts show strong transferability across GUI agents, with improvements up to +46% when replaying prompts evolved on one model to another.",
       "evidence": "Table 4 shows cross-agent ASR for pop-up scenarios. Qwen2.5-VL→GPT-4V achieves +46% improvement. Most source-target pairs show positive transfer for EVA over baseline.",
       "supported": "moderate"
     },
     {
       "claim": "GUI agents are inherently resistant to high-risk injection scenarios such as payment fraud.",
       "evidence": "Table 3 shows 0% attack success for payment scenarios across all six models. The paper notes agents 'either ignore or explicitly reject the injected content.'",
       "supported": "strong"
     },
     {
       "claim": "Persuasive (49.8%) and urgency (40.0%) strategies dominate successful indirect prompt injections, with model-specific susceptibility patterns.",
       "evidence": "Table 5 and Figures 7-9 provide strategy distribution analysis. UI-TARS-7B-DPO shows 50.8% sensitivity to urgency while GPT-4V shows 51.6% to persuasive content.",
       "supported": "moderate"
     },
     {
       "claim": "Goal information significantly boosts attack success; removing user goals from adversarial prompts reduces ASR by 2-24 percentage points.",
       "evidence": "Table 7 (Appendix D) shows w/ Goal vs w/o Goal comparison across 6 models in pop-up scenario. Largest drop: GLM-4v-Plus (-24%), smallest: UI-TARS-7B-DPO (-2%).",
       "supported": "moderate"
     },
     {
       "claim": "Visual attention concentration is the key factor determining injection success — concentrated attention on injected elements leads to higher ASR than dispersed attention.",
       "evidence": "Figure 4 shows attention heatmaps for pop-up (concentrated, successful) vs chat link (dispersed, unsuccessful). Section 5.2 discusses the mechanism qualitatively.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "No statistical significance testing",
       "detail": "All claims that EVA 'outperforms' or 'improves' are based on raw percentage comparisons from 50 samples per condition. With n=50, many of the reported differences (e.g., +2% on Qwen2.5-VL for chat) may not be statistically significant. No confidence intervals, p-values, or other statistical tests are reported for any comparison."
     },
     {
       "flag": "Self-created baseline favors the proposed method",
       "detail": "The static baseline is the authors' own creation (single-pass GLM-4v-Plus generations) rather than a published prior attack method. Despite citing AdvWeb, WASP, and other existing attack frameworks, none are included as experimental comparisons. The baseline may be deliberately simple to maximize the appearance of EVA's improvement."
     },
     {
       "flag": "Compute budget confound",
       "detail": "EVA uses up to 10 optimization iterations with 10 evaluations each per sample, while the static baseline generates samples in a single pass. The improvement could partially reflect having more compute/interaction budget rather than the quality of the adaptive algorithm. No compute-matched comparison is provided."
     },
     {
       "flag": "Automated evaluation without human validation",
       "detail": "Attack success is judged entirely by an LLM-based prompt (Appendix B.5) that classifies agent responses as success/failure/invalid. The reliability and accuracy of this automated judge are not validated against human judgments. Errors in the judge could systematically bias results."
     },
     {
       "flag": "Claimed but unreleased artifacts",
       "detail": "Contribution (ii) explicitly states 'We build and release a reproducible evaluation pipeline' but no code repository URL, data archive, or download link appears in the paper. This is a claim of artifact release without evidence of actual release."
     },
     {
       "flag": "Small sample sizes for some claims",
       "detail": "With 50 samples per condition, many reported differences are small in absolute terms (e.g., +2 percentage points = 1 additional success out of 50). The persuasion strategy analysis (Table 5) subdivides successful attacks further, resulting in very small cell counts for some strategy-scenario-model combinations."
     }
   ],
   "cited_papers": [
     {
       "title": "Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "Foundational work formalizing indirect prompt injection risks in real-world LLM toolchains, directly relevant to the attack paradigm EVA builds upon."
     },
     {
       "title": "Caution for the environment: Multimodal agents are susceptible to environmental distractions",
       "authors": ["Xinbei Ma", "Yiting Wang", "Yao Yao", "Tongxin Yuan", "Aston Zhang", "Zhuosheng Zhang", "Hai Zhao"],
       "year": 2024,
       "arxiv_id": "2408.02544",
       "relevance": "Empirically demonstrates multimodal GUI agents' susceptibility to visual distractions, establishing the vulnerability EVA exploits."
     },
     {
       "title": "Attacking vision-language computer agents via pop-ups",
       "authors": ["Yanzhe Zhang", "Tao Yu", "Diyi Yang"],
       "year": 2024,
       "arxiv_id": "2411.02391",
       "relevance": "Demonstrates pop-up-based attacks on vision-language agents, a key injection scenario evaluated in EVA."
     },
     {
       "title": "EIA: Environmental injection attack on generalist web agents for privacy leakage",
       "authors": ["Zeyi Liao", "Lingbo Mo", "Chejian Xu", "Mintong Kang", "Jiawei Zhang", "Chaowei Xiao", "Yuan Tian", "Bo Li", "Huan Sun"],
       "year": 2025,
       "relevance": "Formalizes environmental injection attacks on web agents for privacy leakage, directly related to the threat model EVA addresses."
     },
     {
       "title": "Adaptive attacks break defenses against indirect prompt injection attacks on LLM agents",
       "authors": ["Qiusi Zhan", "Richard Fang", "Henil Shalin Panchal", "Daniel Kang"],
       "year": 2025,
       "arxiv_id": "2503.00061",
       "relevance": "Proposes joint layout-text optimization for adaptive attacks on LLM agents, a closely related concurrent approach to EVA's evolving injection strategy."
     },
     {
       "title": "WASP: Benchmarking web agent security against prompt injection attacks",
       "authors": ["Ivan Evtimov", "Arman Zharmagambetov", "Aaron Grattafiori", "Chuan Guo", "Kamalika Chaudhuri"],
       "year": 2025,
       "arxiv_id": "2504.18575",
       "relevance": "Provides standardized benchmarks for evaluating web agent security against prompt injection, directly relevant to systematic evaluation of GUI agent vulnerabilities."
     },
     {
       "title": "AdvWeb: Controllable black-box attacks on VLM-powered web agents",
       "authors": ["Chejian Xu", "Mintong Kang", "Jiawei Zhang", "Zeyi Liao", "Lingbo Mo", "Mengqi Yuan", "Huan Sun", "Bo Li"],
       "year": 2024,
       "arxiv_id": "2410.17401",
       "relevance": "DOM-level perturbation tool for black-box attacks on vision-language web agents, a direct comparison point for EVA's attack methodology."
     },
     {
       "title": "Sleeper agents: Training deceptive LLMs that persist through safety training",
       "authors": ["Evan Hubinger", "Carson Denison", "Jesse Mu"],
       "year": 2024,
       "arxiv_id": "2401.05566",
       "relevance": "Introduces hidden-trigger deceptive behaviors in LLMs that persist through safety training, relevant to understanding latent vulnerabilities EVA seeks to exploit."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Foundational work on transferable adversarial attacks against aligned LLMs, establishing key concepts EVA extends to the multimodal GUI setting."
     },
     {
       "title": "AutoDAN: Generating stealthy jailbreak prompts on aligned large language models",
       "authors": ["Xiaogeng Liu", "Nan Xu", "Muhao Chen", "Chaowei Xiao"],
       "year": 2024,
       "relevance": "Automated generation of stealthy jailbreak prompts, related to EVA's evolutionary approach to crafting effective adversarial content."
     },
     {
       "title": "UI-TARS: Pioneering automated GUI interaction with native agents",
       "authors": ["Yujia Qin", "Yining Ye", "Junjie Fang"],
       "year": 2025,
       "arxiv_id": "2501.12326",
       "relevance": "One of the six GUI agents evaluated as a target in EVA's red-teaming experiments, representing specialist GUI agent architecture."
     },
     {
       "title": "OS-ATLAS: Foundation action model for generalist GUI agents",
       "authors": ["Zhiyong Wu", "Zhenyu Wu", "Fangzhi Xu"],
       "year": 2025,
       "relevance": "One of the six GUI agents evaluated as a target in EVA's experiments, representing generalist GUI agent design."
     },
     {
       "title": "Jailbreaking black box large language models in twenty queries",
       "authors": ["Patrick Chao", "Alexander Robey", "Edgar Dobriban", "Hamed Hassani", "George J. Pappas", "Eric Wong"],
       "year": 2024,
       "relevance": "Black-box jailbreaking methodology using iterative refinement, conceptually related to EVA's feedback-driven optimization of adversarial injections."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Security researchers and GUI agent developers can apply EVA's methodology to test their systems, though no code is released for direct use."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The finding that adaptive attacks outperform static ones is expected; the transferability results and payment resistance are mildly surprising but not contrarian."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates effective attacks against GUI agents including phishing and manipulation scenarios, with transferable patterns raising concern about deployed agents."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Shows commercial agents (GPT-4V, GPT-4o) are vulnerable to evolved attacks, but no major controversy or accusatory framing."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, demo, or tool is released despite claiming to 'build and release a reproducible evaluation pipeline.'"
     },
     "brand_recognition": {
       "score": 2,
       "justification": "Tests against well-known commercial models (GPT-4V, GPT-4o from OpenAI; Qwen2.5-VL from Alibaba) which attract attention."
     }
   }
 }