os-sentinel-safety-mobile-gui-agents

name	os-sentinel-safety-mobile-gui-agents
title	OS-Sentinel: Safety-Enhanced Mobile GUI Agents via Hybrid Validation
version	0.0.2
engine	skillxiv-v0.0.2-claude-opus-4.6
license	MIT
url	https://arxiv.org/abs/2510.24411
keywords	["Mobile Agents","Safety Detection","VLM Validation","System Security","Risk Detection"]
description	Detect safety violations in mobile GUI agents using dual mechanisms: formal verification rules for system-level risks (privilege escalation, credential exposure) and VLM-based contextual judges evaluating action appropriateness, achieving 10-30% safety improvement over baselines.

Title: Dual-Mechanism Safety Detection for Mobile Autonomous Agents

Autonomous mobile agents powered by vision-language models can accidentally compromise system security or leak sensitive data. OS-Sentinel adds a safety layer that prevents harmful actions through formal verification (detecting explicit rule violations) and contextual judgment (evaluating whether actions make sense given task goals).

The approach operates at two levels: formal rules catch absolute violations, while VLM judges catch subtle contextual risks that rules might miss.

Core Concept

Hybrid Safety Validation:

• Formal Verifier: Rule-based system detecting explicit violations (privilege escalation, credential patterns, sensitive keywords)
• VLM-Based Judge: Evaluates step-level or trajectory-level action appropriateness given task context
• Dual-Pass Detection: Action must pass both checks to proceed
• Real-World Risk Taxonomy: 10-category risk framework from 204 annotated mobile trajectories

This combines the transparency and certainty of formal rules with the semantic understanding of VLMs.

Architecture Overview

• Formal Verifier: Filesystem hash monitoring, keyword/regex pattern matching for sensitive data
• VLM Judge: Vision-language model fine-tuned on MobileRisk trajectories to recognize contextual risks
• Risk Taxonomy: 10 categories spanning financial, personal, and system security risks
• Evaluation Scope: Step-level (individual actions) and trajectory-level (aggregate risk)
• MobileRisk Benchmark: 204 trajectories (102 safe, 102 unsafe) across 48 applications

Implementation Steps

1. Design Formal Verifier with Three Components

Implement a rule-based verifier combining system state monitoring, sensitive keyword detection, and pattern matching.

class FormalVerifier:
    def __init__(self):
        # System state: track filesystem metadata hashes
        self.filesystem_baseline = self.compute_baseline_hashes()

        # Sensitive keywords: financial, PII, credentials
        .sensitive_keywords = {
            : ,
            : ,
            : ,
            : 
        }

     ():
        
         action. == :
             action.target_permission   current_permissions
         

     ():
        
         keyword, pattern  .sensitive_keywords.items():
             re.search(pattern, text_output):
                 keyword
         

     ():
        
        has_escalation = .check_privilege_escalation(action, .current_perms)
        exposed_data = .check_sensitive_data_exposure(action.text)
        filesystem_changed = .check_filesystem_integrity()

          (has_escalation  exposed_data  filesystem_changed)