{"id":"https://openalex.org/W4416034865","doi":"https://doi.org/10.18653/v1/2025.findings-emnlp.411","title":"Hidden Ghost Hand: Unveiling Backdoor Vulnerabilities in MLLM-Powered Mobile GUI Agents","display_name":"Hidden Ghost Hand: Unveiling Backdoor Vulnerabilities in MLLM-Powered Mobile GUI Agents","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4416034865","doi":"https://doi.org/10.18653/v1/2025.findings-emnlp.411"},"language":null,"primary_location":{"id":"doi:10.18653/v1/2025.findings-emnlp.411","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2025.findings-emnlp.411","pdf_url":"https://aclanthology.org/2025.findings-emnlp.411.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: EMNLP 2025","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://aclanthology.org/2025.findings-emnlp.411.pdf","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5009313267","display_name":"Pengzhou Cheng","orcid":"https://orcid.org/0000-0003-0945-8790"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pengzhou Cheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100599363","display_name":"Hong Hu","orcid":"https://orcid.org/0000-0002-7443-0885"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Haowen Hu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001288130","display_name":"Zheng Yi Wu","orcid":"https://orcid.org/0000-0002-5971-8338"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zheng Wu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100585973","display_name":"Zongru Wu","orcid":"https://orcid.org/0000-0002-5387-7821"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zongru Wu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035829367","display_name":"Tianjie Ju","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tianjie Ju","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5014216659","display_name":"Daizong Ding","orcid":"https://orcid.org/0000-0002-4722-5229"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Daizong Ding","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056812241","display_name":"Zhuosheng Zhang","orcid":"https://orcid.org/0000-0002-2710-5115"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhuosheng Zhang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5085695760","display_name":"Gongshen Liu","orcid":"https://orcid.org/0000-0001-5194-1570"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gongshen Liu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"7781","last_page":"7805"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12203","display_name":"Mobile Agent-Based Network Management","score":0.4180999994277954,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12203","display_name":"Mobile Agent-Based Network Management","score":0.4180999994277954,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.11540000140666962,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10639","display_name":"Advanced Software Engineering Methodologies","score":0.06920000165700912,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9136000275611877},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.30000001192092896},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.28790000081062317},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.2639999985694885},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.2567000091075897}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9136000275611877},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6068000197410583},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5893999934196472},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.30000001192092896},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.28790000081062317},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.2639999985694885},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.2567000091075897},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.2538999915122986},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.23469999432563782},{"id":"https://openalex.org/C2776654903","wikidata":"https://www.wikidata.org/wiki/Q2601463","display_name":"SAFER","level":2,"score":0.23019999265670776}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.18653/v1/2025.findings-emnlp.411","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2025.findings-emnlp.411","pdf_url":"https://aclanthology.org/2025.findings-emnlp.411.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: EMNLP 2025","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.18653/v1/2025.findings-emnlp.411","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2025.findings-emnlp.411","pdf_url":"https://aclanthology.org/2025.findings-emnlp.411.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: EMNLP 2025","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4416034865.pdf","grobid_xml":"https://content.openalex.org/works/W4416034865.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Graphical":[0],"user":[1],"interface":[2],"(GUI)":[3],"agents":[4,30,56,99],"powered":[5],"by":[6,34,91],"multimodal":[7],"large":[8],"language":[9],"models":[10],"(MLLMs)":[11],"have":[12],"shown":[13],"greater":[14],"promise":[15],"for":[16,82],"human-interaction.However,":[17],"due":[18],"to":[19,100,122,143,194],"the":[20,124,131,137,145,191],"high":[21],"fine-tuning":[22,142],"cost,":[23],"users":[24],"often":[25],"rely":[26],"on":[27,71,170],"opensource":[28],"GUI":[29,55,98],"or":[31],"APIs":[32],"offered":[33],"AI":[35],"providers,":[36],"which":[37],"introduces":[38],"a":[39,113,184],"critical":[40],"but":[41],"underexplored":[42],"supply":[43],"chain":[44],"threat:":[45],"backdoor":[46,84,110,148],"attacks.In":[47],"this":[48,72],"work,":[49],"we":[50,74,86,108,182],"first":[51,87],"unveil":[52],"that":[53,117,158,167,189],"MLLMpowered":[54],"naturally":[57],"expose":[58],"multiple":[59],"interaction-level":[60],"triggers,":[61],"such":[62],"as":[63,112],"historical":[64],"steps,":[65],"environment":[66],"states,":[67],"and":[68,79,94,149,154,162,174],"task":[69,106],"progress.Based":[70],"observation,":[73],"introduce":[75],"Agent-Ghost,":[76],"an":[77],"effective":[78,161],"stealthy":[80],"framework":[81],"red-teaming":[83],"attacks.Specifically,":[85],"construct":[88],"composite":[89],"triggers":[90],"combining":[92],"goal":[93],"interaction":[95],"levels,":[96],"allowing":[97],"unintentionally":[101],"activate":[102],"backdoors":[103],"while":[104],"ensuring":[105],"utility.Then,":[107],"formulate":[109],"injection":[111],"Min-Max":[114],"optimization":[115],"problem":[116],"uses":[118],"supervised":[119,141],"contrastive":[120],"learning":[121],"maximize":[123],"feature":[125],"difference":[126],"across":[127],"sample":[128],"classes":[129],"at":[130],"representation":[132],"space,":[133],"improving":[134],"flexibility":[135],"of":[136],"backdoor.Meanwhile,":[138],"it":[139],"adopts":[140],"minimize":[144],"discrepancy":[146],"between":[147],"clean":[150],"behavior,":[151],"enhancing":[152],"effectiveness":[153],"utility.Extensive":[155],"results":[156],"show":[157],"AgentGhost":[159,188],"is":[160],"generic,":[163],"with":[164,177],"attack":[165,172,192],"accuracy":[166,193],"reaches":[168],"99.7%":[169],"three":[171],"objectives,":[173],"shows":[175],"stealthiness":[176],"only":[178],"1%":[179],"utility":[180],"degradation.Furthermore,":[181],"tailor":[183],"defense":[185],"method":[186],"against":[187],"reduces":[190],"22.1%":[195],"1":[196],".":[197]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-11-08T00:00:00"}