← Back to Library

Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System

Authors: Zhenhua Zou, Sheng Guo, Qiuyang Zhan, Lepeng Zhao, Shuo Li, Qi Li, Ke Xu, Mingwei Xu, Zhuotao Liu

Published: 2026-02-11

arXiv ID: 2602.10915v2

Added to Library: 2026-02-13 03:01 UTC

📄 Abstract

The evolution of Large Language Models (LLMs) has shifted mobile computing from App-centric interactions to system-level autonomous agents. Current implementations predominantly rely on a "Screen-as-Interface" paradigm, which inherits structural vulnerabilities and conflicts with the mobile ecosystem's economic foundations. In this paper, we conduct a systematic security analysis of state-of-the-art mobile agents using Doubao Mobile Assistant as a representative case. We decompose the threat landscape into four dimensions - Agent Identity, External Interface, Internal Reasoning, and Action Execution - revealing critical flaws such as fake App identity, visual spoofing, indirect prompt injection, and unauthorized privilege escalation stemming from a reliance on unstructured visual data. To address these challenges, we propose Aura, an Agent Universal Runtime Architecture for a clean-slate secure agent OS. Aura replaces brittle GUI scraping with a structured, agent-native interaction model. It adopts a Hub-and-Spoke topology where a privileged System Agent orchestrates intent, sandboxed App Agents execute domain-specific tasks, and the Agent Kernel mediates all communication. The Agent Kernel enforces four defense pillars: (i) cryptographic identity binding via a Global Agent Registry; (ii) semantic input sanitization through a multilayer Semantic Firewall; (iii) cognitive integrity via taint-aware memory and plan-trajectory alignment; and (iv) granular access control with non-deniable auditing. Evaluation on MobileSafetyBench shows that, compared to Doubao, Aura improves low-risk Task Success Rate from roughly 75% to 94.3%, reduces high-risk Attack Success Rate from roughly 40% to 4.4%, and achieves near-order-of-magnitude latency gains. These results demonstrate Aura as a viable, secure alternative to the "Screen-as-Interface" paradigm.

🔍 Key Points

  • Identifies a critical flaw in the weighted-average approach for scoring multi-turn LLM attack detection, proving it is unsuitable due to its mathematical properties.
  • Proposes the peak + accumulation scoring formula that combines peak risk, persistence ratio, and category diversity, providing a more effective way to assess multi-turn conversation risks.
  • Achieves impressive evaluation metrics on a large dataset, with 90.8% recall at a 1.20% false positive rate, which indicates robustness and efficacy in detecting multi-turn prompt injection attacks.
  • Introduces a sensitivity analysis revealing a significant performance phase transition at a specific parameter value, highlighting the importance of parameter tuning in the detection process.
  • Releases the scoring algorithm, regex pattern library, and evaluation framework as open source, promoting transparency and further research in LLM attack detection.

💡 Why This Paper Matters

This paper presents a novel and necessary advancement in the detection of multi-turn prompt injection attacks among LLMs. By introducing the peak + accumulation scoring formula, the authors effectively address limitations of existing methods, enabling more reliable and efficient detection of attacks that span multiple conversational turns. Given the critical need for robust AI security mechanisms, the contributions of this work are not only relevant but vital for enhancing safety in AI applications.

🎯 Why It's Interesting for AI Security Researchers

This paper will attract AI security researchers due to its direct implications for securing LLMs against sophisticated attacks. As AI systems are increasingly incorporated into sensitive and high-stakes environments, understanding and mitigating risks associated with prompt injection attacks becomes paramount. The innovative scoring method presented offers a substantial improvement over existing approaches, making it a crucial reference for researchers aiming to develop more effective defenses against multifaceted attack patterns.

📚 Read the Full Paper

📄 View on arXiv 📎 Download PDF