AegisUI: Behavioral Anomaly Detection for Structured User Interface Protocols in AI Agent Systems

• URL: http://arxiv.org/abs/2603.05031v1
• Date: Thu, 05 Mar 2026 10:24:43 GMT
• Title: AegisUI: Behavioral Anomaly Detection for Structured User Interface Protocols in AI Agent Systems
• Abstract summary: Current defenses stop at syntax; they were never built to catch this kind of behavioral mismatch.<n>AegisUI generates structured UI payloads, injects realistic attacks into them, extracts numeric features, and benchmarks anomaly detectors end-to-end.<n>We produced 4000 labeled payloads spanning five application domains and five attack families.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: AI agents that build user interfaces on the fly assembling buttons, forms, and data displays from structured protocol payloads are becoming common in production systems. The trouble is that a payload can pass every schema check and still trick a user: a button might say "View invoice" while its hidden action wipes an account, or a display widget might quietly bind to an internal salary field. Current defenses stop at syntax; they were never built to catch this kind of behavioral mismatch. We built AegisUI to study exactly this gap. The framework generates structured UI payloads, injects realistic attacks into them, extracts numeric features, and benchmarks anomaly detectors end-to-end. We produced 4000 labeled payloads (3000 benign, 1000 malicious) spanning five application domains and five attack families: phishing interfaces, data leakage, layout abuse, manipulative UI, and workflow anomalies. From each payload we extracted 18 features covering structural, semantic, binding, and session dimensions, then compared three detectors: Isolation Forest (unsupervised), a benign-trained autoencoder (semi-supervised), and Random Forest (supervised). On a stratified 80/20 split, Random Forest scored best overall (accuracy 0.931, precision 0.980, recall 0.740, F1 0.843, ROC-AUC 0.952). The autoencoder came second (F1 0.762, ROC-AUC 0.863) and needs no malicious labels at training time, which matters when deploying a new system that lacks attack history. Per-attack-type analysis showed that layout abuse is easiest to catch while manipulative UI payloads are hardest. All code, data, and configurations are released for full reproducibility.

Related papers

• ADeptS-Bench: Measuring the Trustworthiness of Computer Use Agents Across Devices [48.36933831982682]
  We introduce ADeptS-Bench, a trustworthiness benchmark grounded in the ADEPTS capability framework.<n>The Safety stream provides paired benign/malicious tasks with threats embedded in the visual interface.<n>The Disambiguation stream evaluates whether agents seek clarification when intent is ambiguous.
  arXiv  Detail & Related papers  (2026-08-25T23:21:57Z)
• Enhancing Attack Detection Capabilities in BACnet/IP Networks Using Machine-Learning Models [0.0]
  Building Automation Systems (BAS) manage critical building functions using protocols such as BACnet/IP.<n>BAS defenders have limited tooling and few labeled datasets for detecting BACnet-specific attacks.<n>One-Class SVM achieved the strongest overall performance, with an average F1 score of 0.864 across all attacks.
  arXiv  Detail & Related papers  (2026-07-22T19:37:44Z)
• Routing Ceilings Are Domain-Independent: Structural Prior Injection in Code Security Vulnerability Detection [0.0]
  Large language models (LLMs) exhibit a well-documented gap between latent capability and consistent activation.<n>Prior work reports that structural priors raise in-distribution performance dramatically, yet collapse below the zero-shot baseline out-of-distribution.<n>We test whether this phenomenon is cross-domain by reproducing the SAIR design in source-code security vulnerability detection.
  arXiv  Detail & Related papers  (2026-07-16T06:45:08Z)
• Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection [0.0]
  This work proposes seven detection techniques that each port a specific mechanism from a discipline outside large-language--model security.<n>Three of the seven techniques are implemented in the prompt-shield v0.4.1 release (Apache 2.0) and evaluated in a four-configuration ablation across six datasets.
  arXiv  Detail & Related papers  (2026-04-20T13:27:05Z)
• VibeGuard: A Security Gate Framework for AI-Generated Code [0.11080037957254413]
  Anthropic's Claude Code CLI shipped a 59.8 MB source map file in its npm package exposing 512,000 lines of proprietary TypeScript.<n>We present VibeGuard, a pre-publish security gate that targets five such blind spots.<n>We discuss how these results inform a defense-in-depth workflow for teams that rely on AI code generation.
  arXiv  Detail & Related papers  (2026-04-01T15:57:01Z)
• CLASP: Defending Hybrid Large Language Models Against Hidden State Poisoning Attacks [48.54598003197356]
  State space models (SSMs) like Mamba have gained significant traction as efficient alternatives to Transformers.<n>HiSPAs, a recently discovered vulnerability that corrupts SSM memory through adversarial strings, pose a critical threat to these architectures.<n>We introduce the CLASP model to defend against this threat.
  arXiv  Detail & Related papers  (2026-03-12T17:29:55Z)
• Synthesizing the Kill Chain: A Zero-Shot Framework for Target Verification and Tactical Reasoning on the Edge [12.201060368447251]
  This paper introduces a hierarchical, zero-shot framework that cascades lightweight object detection with compact Vision-Language Models (VLMs)<n>We evaluate this pipeline on 55 high-fidelity synthetic videos from Battlefield 6 across three tasks: false-positive filtering (up to 100% accuracy), damage assessment (up to 97.5%), and fine-grained vehicle classification (55-90%)
  arXiv  Detail & Related papers  (2026-02-10T23:00:19Z)
• Structural Representations for Cross-Attack Generalization in AI Agent Threat Detection [0.0]
  We introduce structural tokenization, encoding execution-flow patterns (tool calls, arguments, observations) rather than conversational content.<n>For attacks requiring linguistic features, we propose gated multi-view fusion that adaptively combines both representations.<n>Our findings reveal that AI agent security is fundamentally a structural problem: attack semantics reside in execution patterns, not surface language.
  arXiv  Detail & Related papers  (2026-01-05T01:51:40Z)
• The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search [58.8834056209347]
  Large language models (LLMs) remain vulnerable to jailbreak attacks that bypass safety guardrails to elicit harmful outputs.<n>We introduce the Correlated Knowledge Attack Agent (CKA-Agent), a dynamic framework that reframes jailbreaking as an adaptive, tree-structured exploration of the target model's knowledge base.
  arXiv  Detail & Related papers  (2025-12-01T07:05:23Z)
• Assimilation Matters: Model-level Backdoor Detection in Vision-Language Pretrained Models [71.44858461725893]
  Given a model fine-tuned by an untrusted third party, determining whether the model has been injected with a backdoor is a critical and challenging problem.<n>Existing detection methods usually rely on prior knowledge of training dataset, backdoor triggers and targets.<n>We introduce Assimilation Matters in DETection (AMDET), a novel model-level detection framework that operates without any such prior knowledge.
  arXiv  Detail & Related papers  (2025-11-29T06:20:00Z)
• Every Character Counts: From Vulnerability to Defense in Phishing Detection [22.101976874889147]
  Phishing attacks targeting both organizations and individuals are becoming an increasingly significant threat.<n>Current automatic detection methods often lack explainability and robustness in detecting new phishing attacks.<n>We investigate the effectiveness of character-level deep learning models for phishing detection, which can provide both robustness and interpretability.
  arXiv  Detail & Related papers  (2025-09-24T22:03:30Z)
• AI-Driven Cybersecurity Threat Detection: Building Resilient Defense Systems Using Predictive Analytics [0.7273611076094216]
  This study examines how Artificial Intelligence can aid in identifying and mitigating cyber threats in the U.S.<n>It looks at intrusion detection, malware classification, phishing detection, and insider threat analysis.
  arXiv  Detail & Related papers  (2025-08-02T16:03:35Z)
• $\texttt{Droid}$: A Resource Suite for AI-Generated Code Detection [75.6327970381944]
  $textbf$textttDroidCollection$$ is an open data suite for training and evaluating machine-generated code detectors.<n>It includes over a million code samples, seven programming languages, outputs from 43 coding models, and three real-world coding domains.<n>We also develop a suite of encoder-only detectors trained using a multi-task objective over $textttDroidCollection$$.
  arXiv  Detail & Related papers  (2025-07-11T12:19:06Z)
• OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents [60.78202583483591]
  We introduce OS-Harm, a new benchmark for measuring safety of computer use agents.<n> OS-Harm is built on top of the OSWorld environment and aims to test models across three categories of harm: deliberate user misuse, prompt injection attacks, and model misbehavior.<n>We evaluate computer use agents based on a range of frontier models and provide insights into their safety.
  arXiv  Detail & Related papers  (2025-06-17T17:59:31Z)
• DyePack: Provably Flagging Test Set Contamination in LLMs Using Backdoors [52.85182605005619]
  We introduce DyePack, a framework that leverages backdoor attacks to identify models that used benchmark test sets during training.<n>Like how banks mix dye packs with their money to mark robbers, DyePack mixes backdoor samples with the test data to flag models that trained on it.<n>We evaluate DyePack on five models across three datasets, covering both multiple-choice and open-ended generation tasks.
  arXiv  Detail & Related papers  (2025-05-29T02:22:14Z)
• BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systems [62.17474934536671]
  We introduce the first framework to capture offensive and defensive cyber-capabilities in evolving real-world systems.<n>To capture the vulnerability lifecycle, we define three task types: Detect (detecting a new vulnerability), Exploit (exploiting a specific vulnerability), and Patch (patching a specific vulnerability)<n>We evaluate 8 agents: Claude Code, OpenAI Codex CLI with o3-high and o4-mini, and custom agents with o3-high, GPT-4.1, Gemini 2.5 Pro Preview, Claude 3.7 Sonnet Thinking, and DeepSeek-R1.
  arXiv  Detail & Related papers  (2025-05-21T07:44:52Z)
• Nosy Layers, Noisy Fixes: Tackling DRAs in Federated Learning Systems using Explainable AI [4.6383368787236385]
  Federated Learning (FL) has emerged as a powerful paradigm for collaborative model training.<n>It is vulnerable to Data Reconstruction Attacks (DRA)<n>We introduce DRArmor, a novel defense mechanism that integrates Explainable AI with targeted detection and mitigation strategies for DRA.
  arXiv  Detail & Related papers  (2025-05-16T07:28:15Z)
• Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense [56.077252790310176]
  We present a paraphrase generation model (DIPPER) that can paraphrase paragraphs, condition on surrounding context, and control lexical diversity and content reordering. Using DIPPER to paraphrase text generated by three large language models (including GPT3.5-davinci-003) successfully evades several detectors, including watermarking. We introduce a simple defense that relies on retrieving semantically-similar generations and must be maintained by a language model API provider.
  arXiv  Detail & Related papers  (2023-03-23T16:29:27Z)
• Sample Efficient Detection and Classification of Adversarial Attacks via Self-Supervised Embeddings [40.332149464256496]
  Adrial robustness of deep models is pivotal in ensuring safe deployment in real world settings. We propose a self-supervised method to detect adversarial attacks and classify them to their respective threat models. We use a SimCLR encoder in our experiments, since we show the SimCLR embedding distance is a good proxy for human perceptibility.
  arXiv  Detail & Related papers  (2021-08-30T16:39:52Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.