SeerGuard uses a world model to vet mobile GUI agent taps

The interesting part of mobile GUI agents right now is not that they can book a flight for you, it is that they can also delete a file, send a message, or confirm a purchase before you notice. A new arXiv paper from Xue Yu, Bo Yuan, Pengshuai Yang, Kailin Zhao, Hong Hu and Junlan Feng argues the fix is not another reactive filter, it is teaching the agent to predict what a tap will do before it does it.

SeerGuard is described as a "consequence-aware safety framework" that puts two checks in front of the agent, an instruction-level screen and an action-level risk assessment. Under the hood is what the authors call a safety-augmented world model, or SAWM, trained via multi-task learning to do two things at once, predict the next GUI state semantically and score how risky the proposed action is. The framing matters because, in the authors' own words, existing safety mechanisms are "primarily reactive, lacking the ability to assess risks before execution."

On the Qwen3-VL-8B-Instruct backbone, the paper reports the safety-utility score climbing from 0.191 to 0.596, and the risk-cost score dropping from 0.347 to 0.130. Take those as the paper's own claim rather than settled benchmarks. The abstract does not name the evaluation suite, and the results are shown on a single model.

What the reporting does not give you is the inference cost of running a world model in front of every tap, whether the approach transfers to closed frontier backbones, or how the screener holds up against user instructions designed to sneak destructive actions through. Those are the questions that matter the moment anyone tries to ship this to a real phone.

If the direction holds, it points at where consumer and enterprise mobile automation is heading, less trust in the agent's own judgment and more trust in a small predictive model sitting between the agent and the operating system. That is a very different deployment shape from the "prompt the LLM to be careful" pattern most current agent stacks still lean on.