MobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency Injection

What it is

MobileInject (arXiv 2610.23307, 16 October 2026, cs.CR) is a benchmark from Nanjing University, Ant Group and Peking University. It tests MLLM-based smartphone agents against indirect injection delivered through content the agent sees while doing a normal task. The fetched text stops partway through the method section. It contains no per-model results, attack success rates or defence evaluations, so the "broad vulnerability" claim cannot be checked from it.

How it works

Each of the 108 instances runs in a resettable Android emulator, not as a static prompt. The agent sees the rendered screenshot and the UI/XML tree. It acts through taps, long presses, swipes and text entry, and app state changes after each action.

The threat model trusts the system prompt and the user's instruction. Everything the agent observes is untrusted. The attacker can only plant payloads in what the agent sees: visual surfaces (screenshots, messages, emails, calendar events, notifications, social content) and textual surfaces (XML hierarchies, accessibility trees, element attributes, app names). The attacker cannot change the system prompt, model weights, OS or user instruction.

Cross-Modal Consistency Injection keeps one adversarial objective fixed and places it in both the visual and textual views of the same screen. The authors compare this with single-channel injection to measure what they call a Cross-Modal Reinforcement Effect.

The benchmark has two layers:

• Core: nine benign workflows (messaging, contact creation, email, social posting, note writing, file management, calendar, paper trading, message-to-web navigation) across 11 app scenarios. A workflow is kept only if it has a natural third-party-content carrier, a resettable initial state and an objective state oracle.
• Stress layer: 12 adversarial objectives in nine consequence categories: content misuse, privacy exposure, financial misconduct, privilege abuse, data-integrity compromise, resource abuse, hazardous-content access, discrimination, and phishing/social engineering.

Success is judged by a state verifier on the end state. The diagnosis framework logs each step's observation, reasoning, action, target element and state. This separates risk recognition, reasoning hijack and action hijack. The paper also lists a reasoning–action transition matrix and a diagnostic visualization profile as outputs.

Preconditions / Affected

The setup targets agents that read both screenshots and UI trees. Agents that use only one channel are covered by the unimodal conditions, not the cross-modal one.

Caveats

The text gives no code or dataset link, and no release status. Multi-Role Collaborative Deception and Reasoning-Camouflage Injection are named but not described in the fetched portion. The claim that many failures come from early reasoning hijacking appears only in the abstract.