# MIRAGE: Context-Aware Prompt Injection against Mobile GUI Agents via User-Generated Content Source: [MIRAGE: Context-Aware Prompt Injection against Mobile GUI Agents via User-Generated Content]() Collection index: [llms.txt]() Data updated: 2026-05-29T05:00:05.519Z Authors: Ruoqi Guo, Yi Liu, Gelei Deng, Yiheng Xiong, Yuekang Li, Ying Zhang, Leo Yu Zhang, Lida Zhao, Ji Jie, Yuxiao Lu Published: 2026-05-27T08:09:53.000Z ## Abstract Mobile graphical user interface (GUI) agents driven by vision-language models (VLMs) perceive the screen as rendered pixels and choose actions from what they see, so they cannot reliably separate trusted interface elements from user-generated content. We present MIRAGE (Mobile Injection of Realistic Adversarial GUI Examples), a pipeline that turns benign mobile screenshots into prompt-injection samples by placing attacker-controlled text into ordinary user-generated content regions, without modifying the agent, the application, or the operating system. MIRAGE operates in three stages: a Localizer identifies user-controllable regions on the screenshot, a Generator synthesises context-aware payloads and renders them in the application's native style, and a Curator moderates realism and balances the samples across applications, region types, and attack intents. A key challenge is that an injected screenshot must stay visually indistinguishable from genuine user content while still diverting the agent; we address this by separating the stages that control reach, realism, and distributional balance. On a 1,111-sample benchmark spanning ten applications and eleven attack intents, all five evaluated VLM agents are vulnerable, with attack success rates of 23%-30%, and MIRAGE scores higher on human realism ratings than the strongest prior attack (3.02 versus 2.52 out of 5). We further find that per-sample realism and attack success are uncorrelated, so visual-quality filtering alone cannot reliably defend against this threat. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Realism assessment on 200-sample](): Realism Assessment; 200-sample; Visual Integration: 3.06. - [Dataset Diversity and Coverage Evaluation on MIRAGE](): Dataset Diversity and Coverage Evaluation; MIRAGE full; Goal-text Entropy: 0.933. - [Dataset Diversity and Coverage Evaluation on MIRAGE matched-n](): Dataset Diversity and Coverage Evaluation; MIRAGE matched-n; Goal-text Entropy: 0.927. - [Dataset Diversity and Coverage Evaluation on MIRAGE 3-app overlap](): Dataset Diversity and Coverage Evaluation; MIRAGE 3-app overlap; Goal-Text Entropy: 0.918. - [GUI Agent Attack Success Rate Evaluation on MIRAGE (1,111-sample main set)](): GUI Agent Attack Success Rate Evaluation; MIRAGE (1,111-sample main set); FB Success Rate: not recorded. - [Dataset Diversity and Coverage Evaluation on GhostEI-Bench](): Dataset Diversity and Coverage Evaluation; GhostEI-Bench; Goal-text Entropy: not recorded. - [Dataset Diversity and Coverage Evaluation on AgentHazard 3-app](): Dataset Diversity and Coverage Evaluation; AgentHazard 3-app; Goal-text Entropy: not recorded. - [Dataset Diversity and Coverage Evaluation on AgentHazard full](): Dataset Diversity and Coverage Evaluation; AgentHazard full; Goal-text Entropy: not recorded. ## Original sources and implementation [Original paper]() [PDF]()