{"id":"https://openalex.org/W7163993721","doi":"https://doi.org/10.48550/arxiv.2606.07595","title":"VisualLeakBench: Reproducible Action-Boundary Propagation Failures in Vision-Language Agents","display_name":"VisualLeakBench: Reproducible Action-Boundary Propagation Failures in Vision-Language Agents","publication_year":2026,"publication_date":"2026-05-29","ids":{"openalex":"https://openalex.org/W7163993721","doi":"https://doi.org/10.48550/arxiv.2606.07595"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.07595","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.07595","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.07595","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5129721329","display_name":"Youting Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Youting","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138261005","display_name":"Yuan Tang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tang, Yuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129741071","display_name":"Yitian Qian","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qian, Yitian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138223818","display_name":"Chen Zhao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhao, Chen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.27070000767707825,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.27070000767707825,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.12370000034570694,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12808","display_name":"Ferroelectric and Negative Capacitance Devices","score":0.041999999433755875,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/oracle","display_name":"Oracle","score":0.682699978351593},{"id":"https://openalex.org/keywords/downstream","display_name":"Downstream (manufacturing)","score":0.6477000117301941},{"id":"https://openalex.org/keywords/residual","display_name":"Residual","score":0.5},{"id":"https://openalex.org/keywords/dashboard","display_name":"Dashboard","score":0.4440000057220459},{"id":"https://openalex.org/keywords/boundary","display_name":"Boundary (topology)","score":0.4036000072956085},{"id":"https://openalex.org/keywords/measure","display_name":"Measure (data warehouse)","score":0.3831999897956848},{"id":"https://openalex.org/keywords/leak","display_name":"Leak","score":0.3747999966144562}],"concepts":[{"id":"https://openalex.org/C55166926","wikidata":"https://www.wikidata.org/wiki/Q2892946","display_name":"Oracle","level":2,"score":0.682699978351593},{"id":"https://openalex.org/C2776207758","wikidata":"https://www.wikidata.org/wiki/Q5303302","display_name":"Downstream (manufacturing)","level":2,"score":0.6477000117301941},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6144999861717224},{"id":"https://openalex.org/C155512373","wikidata":"https://www.wikidata.org/wiki/Q287450","display_name":"Residual","level":2,"score":0.5},{"id":"https://openalex.org/C33499554","wikidata":"https://www.wikidata.org/wiki/Q1417134","display_name":"Dashboard","level":2,"score":0.4440000057220459},{"id":"https://openalex.org/C62354387","wikidata":"https://www.wikidata.org/wiki/Q875399","display_name":"Boundary (topology)","level":2,"score":0.4036000072956085},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.3831999897956848},{"id":"https://openalex.org/C2780378346","wikidata":"https://www.wikidata.org/wiki/Q1349983","display_name":"Leak","level":2,"score":0.3747999966144562},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3718999922275543},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.3418000042438507},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.3391000032424927},{"id":"https://openalex.org/C2777042071","wikidata":"https://www.wikidata.org/wiki/Q6509304","display_name":"Leakage (economics)","level":2,"score":0.31299999356269836},{"id":"https://openalex.org/C66283442","wikidata":"https://www.wikidata.org/wiki/Q1389268","display_name":"Failure mode and effects analysis","level":2,"score":0.310699999332428},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.3073999881744385},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3003000020980835},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.29499998688697815},{"id":"https://openalex.org/C2776505523","wikidata":"https://www.wikidata.org/wiki/Q4785468","display_name":"Plan (archaeology)","level":2,"score":0.2858999967575073},{"id":"https://openalex.org/C2776543023","wikidata":"https://www.wikidata.org/wiki/Q2147046","display_name":"Rework","level":2,"score":0.2851000130176544},{"id":"https://openalex.org/C152948882","wikidata":"https://www.wikidata.org/wiki/Q4060686","display_name":"Belief propagation","level":3,"score":0.26969999074935913},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.267300009727478},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.25780001282691956}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.07595","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.07595","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.07595","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.07595","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.4463375508785248,"id":"https://metadata.un.org/sdg/4","display_name":"Quality Education"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Vision-language":[0],"agents":[1],"increasingly":[2],"consume":[3],"screenshots,":[4],"documents,":[5],"and":[6,57,60,77,94],"user":[7],"interfaces":[8],"before":[9],"writing":[10],"to":[11,117],"memory,":[12],"sending":[13],"messages,":[14],"or":[15,32],"invoking":[16],"external":[17,78],"tools.":[18],"We":[19,45,145,154],"study":[20],"a":[21,48,62,101,157],"concrete":[22],"failure":[23],"mode":[24],"in":[25,89],"this":[26],"setting:":[27],"action-boundary":[28],"propagation,":[29,136],"where":[30],"sensitive":[31],"unsafe":[33,139],"visible":[34],"text":[35,140],"is":[36],"copied":[37],"from":[38],"an":[39],"image":[40],"into":[41,86],"downstream":[42,151],"tool":[43,87,114,122,143,168],"arguments.":[44],"present":[46],"VisualLeakBench,":[47],"diversified":[49],"500-image":[50],"benchmark":[51],"spanning":[52],"UI,":[53],"chat,":[54],"document,":[55],"form,":[56],"dashboard":[58],"scenes,":[59],"evaluate":[61],"stratified":[63],"100-image":[64],"agent":[65],"subset":[66],"with":[67],"four":[68],"production":[69],"VLM":[70],"systems":[71],"under":[72],"two":[73],"workflows:":[74],"note":[75],"capture":[76],"handoff.":[79],"At":[80],"baseline,":[81],"target":[82],"strings":[83],"are":[84,129],"propagated":[85],"arguments":[88],"78.8%":[90],"of":[91,96],"PII":[92,113,135],"cases":[93],"85.5%":[95],"rendered":[97,105,138],"unsafe-text":[98,106],"cases.":[99],"Under":[100],"defensive":[102],"system":[103],"prompt,":[104],"propagation":[107,115,148],"remains":[108],"high":[109],"at":[110,166],"52.6%,":[111],"while":[112,170],"falls":[116],"2.0%,":[118],"largely":[119],"by":[120],"suppressing":[121],"use":[123],"rather":[124,149],"than":[125,150],"preserving":[126],"utility.":[127],"Rates":[128],"tool-surface":[130],"dependent:":[131],"search-like":[132],"tools":[133],"suppress":[134],"but":[137],"still":[141],"crosses":[142],"boundaries.":[144],"measure":[146],"visual-to-tool":[147],"instruction":[152],"execution.":[153],"additionally":[155],"provide":[156],"labeled-target":[158],"oracle":[159],"upper-bound":[160],"diagnostic":[161],"that":[162],"localizes":[163],"most":[164],"failures":[165],"the":[167],"boundary":[169],"leaving":[171],"response-side":[172],"leakage":[173],"as":[174],"residual":[175],"risk.":[176]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-10T00:00:00"}