LGWM verifier catches GUI agent hijacks at 0.987 AUC in 17ms

A login screen that appears after a tap on 'Sign in' is expected; the same screen after a tap on 'View order' is an attack. That framing opens Right Screen, Wrong Transition, a new arxiv paper arguing that safety for GUI agents is a property of the transition rather than of the screen, so a monitor that inspects only screens 'can be defeated by reusing a legitimate one.'

The authors introduce LGWM, a decoder-free, action-conditioned world model 'trained without semantic annotation on 1.85M real GUI transitions.' Rather than emitting text, code, or images as prior GUI world models do, LGWM predicts the representation of the next screen directly, so verification reduces to a vector comparison and no second model is needed to interpret the prediction. On RSWT-BENCH, the paper's own diagnostic in which each credential screen appears under both a legitimate and a hijacked transition, the training-free score reaches 0.987 AUC at 17 ms per decision, which the paper reports as 'on par with the strongest closed-source VLMs and about ten AUC points above generative GUI world models at over three orders of magnitude lower latency.'

A second signal, the residual direction, reaches 0.953 AUC at separating harmful from benign violations, 'where prompted VLMs are near chance.' The abstract reports no per-app breakdown, no live-agent deployment numbers, and no results against adaptive attackers aware of the embedding; the headline figures sit on the authors' constructed benchmark.