{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/attacking-vision-language-computer-agents-via","title":"Attacking Vision-Language Computer Agents via Pop-ups","arxiv_id":"2411.02391","date":"2024-11-04","proceeding":null,"authors":["Yanzhe Zhang","Tao Yu","Diyi Yang"],"abstract":"Autonomous agents powered by large vision and language models (VLM) have demonstrated significant potential in completing daily computer tasks, such as browsing the web to book travel and operating desktop software, which requires agents to understand these interfaces. Despite such visual inputs becoming more integrated into agentic applications, what types of risks and attacks exist around them still remain unclear. In this work, we demonstrate that VLM agents can be easily attacked by a set of carefully designed adversarial pop-ups, which human users would typically recognize and ignore. This distraction leads agents to click these pop-ups instead of performing the tasks as usual. Integrating these pop-ups into existing agent testing environments like OSWorld and VisualWebArena leads to an attack success rate (the frequency of the agent clicking the pop-ups) of 86% on average and decreases the task success rate by 47%. Basic defense techniques such as asking the agent to ignore pop-ups or including an advertisement notice, are ineffective against the attack.","url_abs":"https://arxiv.org/abs/2411.02391v1","url_pdf":"https://arxiv.org/pdf/2411.02391v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"attacking-vision-language-computer-agents-via","repo_url":"https://github.com/SALT-NLP/PopupAttack","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok"}}],"tasks":[],"methods":[{"method_slug":"set","method_name":"SET"},{"method_slug":null,"method_name":"Travel"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2411.02391","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2411.02391"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/SALT-NLP/PopupAttack","reach":{"status":"ok"}}],"summary":{"unverified":16},"by_repo_kind":{"official":{"samples":16,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":16,"samples":[{"code_sha256_prefix":"4772f6288703d5f7","entry":"analyze_log_file","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/log_analysis.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/log_analysis.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4772f6288703d5f7"}},{"code_sha256_prefix":"d46b9709f936fe42","entry":"center_text","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/mm_agents/agent.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/mm_agents/agent.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d46b9709f936fe42"}},{"code_sha256_prefix":"c0b253631aa070d0","entry":"count_actions_and_attacks","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/log_analysis.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/log_analysis.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c0b253631aa070d0"}},{"code_sha256_prefix":"1fbb4a6526e068b8","entry":"draw_edges_inside_bounding_box_pil","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/attack.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1fbb4a6526e068b8"}},{"code_sha256_prefix":"1f6e5c9e49651728","entry":"ensure_list","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/image_processing.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/image_processing.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1f6e5c9e49651728"}},{"code_sha256_prefix":"491874927ca0052c","entry":"euclidean_distance","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/general_attack_utils.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/general_attack_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"491874927ca0052c"}},{"code_sha256_prefix":"ed4dcdc0e6dfd7b5","entry":"extract_object_nouns","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/mm_agents/agent.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/mm_agents/agent.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ed4dcdc0e6dfd7b5"}},{"code_sha256_prefix":"280cf9be80cf4efa","entry":"extract_single_int","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/mm_agents/agent.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/mm_agents/agent.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"280cf9be80cf4efa"}},{"code_sha256_prefix":"4ac83c7f66446f9a","entry":"fill_bounding_box_with_text","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/image_processing.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/image_processing.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4ac83c7f66446f9a"}},{"code_sha256_prefix":"ecfedacb6ac8b031","entry":"find_files_with_prefix","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/general_attack_utils.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/general_attack_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ecfedacb6ac8b031"}},{"code_sha256_prefix":"819fc68d59f74c04","entry":"get_attack_config","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/attack.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"819fc68d59f74c04"}},{"code_sha256_prefix":"41db802880dfcc94","entry":"get_button_name","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/attack.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"41db802880dfcc94"}},{"code_sha256_prefix":"de8269359d95846f","entry":"get_files_with_prefix","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/log_analysis.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/log_analysis.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"de8269359d95846f"}},{"code_sha256_prefix":"0469c5bc537765de","entry":"get_largest_bounding_box_center","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/image_processing.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/image_processing.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0469c5bc537765de"}},{"code_sha256_prefix":"6474985b86ed175b","entry":"get_result","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/show_result.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/show_result.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6474985b86ed175b"}},{"code_sha256_prefix":"34bed00d033e3ba0","entry":"shortest_distance_to_corners","repo":"SALT-NLP/PopupAttack","repo_kind":"official","path":"OSWorld/general_attack_utils.py","file_url":"https://github.com/SALT-NLP/PopupAttack/blob/HEAD/OSWorld/general_attack_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"34bed00d033e3ba0"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}