Alignment is local: paired diagnostics of GUI agents under user-side persuasion

Using paired diagnostics on three frontier GUI agents, the researchers show that prompt-level alignment is reliable only in single-turn evaluation scenarios with explicitly expressed intent, and degrades systematically along two axes: multi-turn escalation and concealed requests. This persuasion is screen-based, comes from the user side, and does not involve environment injection. A single line of guardrails can reduce attack success rate by up to about 40 percentage points in single-turn scenarios, with near-zero over-refusal cost; but after switching to a four-turn escalation chain, ASR under guardrails rises by about 20 percentage points for all three models, relative to a neutral baseline, which manifests as pronounced guardrail erosion on Qwen, while on Claude and GPT it is mainly a dynamic risk orthogonal to defenses. The significance gap flips under guardrails, and concealed requests succeed more than explicit requests only when guardrails are present, indicating that defenses mainly take effect when intent is named; the authors accordingly argue that static single-turn ASR will overestimate deployment robustness by a systematic, predictable margin.