{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,23]],"date-time":"2026-09-23T20:01:11Z","timestamp":1790193671998,"version":"4.1.0"},"reference-count":57,"publisher":"Springer Science and Business Media LLC","issue":"10","license":[{"start":{"date-parts":[[2026,9,23]],"date-time":"2026-09-23T00:00:00Z","timestamp":1790121600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,9,23]],"date-time":"2026-09-23T00:00:00Z","timestamp":1790121600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int J Comput Vis"],"published-print":{"date-parts":[[2026,10]]},"DOI":"10.1007\/s11263-026-03015-7","type":"journal-article","created":{"date-parts":[[2026,9,23]],"date-time":"2026-09-23T19:12:27Z","timestamp":1790190747000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["TAME-MA: Taming Mobile Agents via Trajectory-Level Trustworthiness Under Jailbreak Manipulations"],"prefix":"10.1007","volume":"134","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6154-0233","authenticated-orcid":false,"given":"Siyuan","family":"Liang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tianmeng","family":"Fang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yongcheng","family":"Jing","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hanqing","family":"Zhao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiaxing","family":"Huang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dacheng","family":"Tao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,9,23]]},"reference":[{"key":"3015_CR1","unstructured":"Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F. L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et\u00a0al. (2023). Gpt-4 technical report. arXiv preprint arXiv:2303.08774."},{"key":"3015_CR2","doi-asserted-by":"crossref","unstructured":"Aminian, G., Asadi, A. R., Shenfeld, I., & Mroueh, Y. (2025) Theoretical analysis of kl-regularized rlhf with multiple reference models arXiv:2502.01203 arXiv preprint.","DOI":"10.52202\/085713-3385"},{"issue":"3","key":"3015_CR3","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3641289","volume":"15","author":"Y Chang","year":"2024","unstructured":"Chang, Y., Wang, X., Wang, J., Wu, Y., Yang, L., Zhu, K., Chen, H., Yi, X., Wang, C., Wang, Y., et al. (2024). A survey on evaluation of large language models. ACM Transactions on Intelligent Systems and Technology, 15(3), 1\u201345.","journal-title":"ACM Transactions on Intelligent Systems and Technology"},{"key":"3015_CR4","unstructured":"Chen, J., Yuen, D., Xie, B., Yang, Y., Chen, G., Wu, Z., Yixing, L., Zhou, X., Liu, W., Wang, S., et\u00a0al. (2024). Spa-bench: A comprehensive benchmark for smartphone agent evaluation. In NeurIPS 2024 Workshop on Open-World Agents."},{"key":"3015_CR5","unstructured":"Comanici, G., Bieber, E., Schaekermann, M., Pasupat, I., Sachdeva, N., Dhillon, I., Blistein, M., Ram, O., Zhang, D., Rosen, E., et al. (2025). Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities. arXiv preprint arXiv:2507.06261"},{"key":"3015_CR6","unstructured":"Dai, G., Jiang, S., Cao, T., Li, Y., Yang, Y., Tan, R., Li, M., and Qiu, L. (2025). Advancing mobile gui agents: A verifier-driven approach to practical deployment. arXiv preprint arXiv:2503.15937."},{"key":"3015_CR7","doi-asserted-by":"crossref","unstructured":"Deka, B., Huang, Z., Franzen, C., Hibschman, J., Afergan, D., Li, Y., Nichols, J., and Kumar, R. (2017). Rico: A mobile app dataset for building data-driven design applications. In Proceedings of the 30th annual ACM symposium on user interface software and technology, pages 845\u2013854.","DOI":"10.1145\/3126594.3126651"},{"key":"3015_CR8","doi-asserted-by":"crossref","unstructured":"Deng, S., Xu, W., Sun, H., Liu, W., Tan, T., Liu, J., Li, A., Luan, J., Wang, B., Yan, R., et\u00a0al. (2024). Mobile-bench: An evaluation benchmark for llm-based mobile agents. arXiv preprint arXiv:2407.00993.","DOI":"10.18653\/v1\/2024.acl-long.478"},{"key":"3015_CR9","unstructured":"Dubois, D., & Prade, H. (1980). Fuzzy Sets and Systems: Theory and Applications. Academic Press."},{"issue":"1","key":"3015_CR10","doi-asserted-by":"publisher","first-page":"3094","DOI":"10.1038\/s41467-022-30761-2","volume":"13","author":"N Fei","year":"2022","unstructured":"Fei, N., Lu, Z., Gao, Y., Yang, G., Huo, Y., Wen, J., Lu, H., Song, R., Gao, X., Xiang, T., et al. (2022). Towards artificial general intelligence via a multimodal foundation model. Nature Communications, 13(1), 3094.","journal-title":"Nature Communications"},{"key":"3015_CR11","unstructured":"Feng, D., Qin, B., Huang, C., Zhang, Z., & Lei, W. (2024). Towards analyzing and understanding the limitations of dpo: A theoretical perspective arXiv:2404.04626 arXiv preprint."},{"key":"3015_CR12","unstructured":"Grattafiori, A., Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Vaughan, A., et al. (2024). The Llama 3 Herd of Models. arXiv preprint arXiv:2407.21783."},{"key":"3015_CR13","doi-asserted-by":"crossref","unstructured":"Han, S., Rao, K., Ettinger, A., Jiang, L., Lin, B. Y., Lambert, N., Choi, Y., & Dziri, N. (2024). Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms. Advances in Neural Information Processing Systems,37, 8093\u20138131.","DOI":"10.52202\/079017-0261"},{"key":"3015_CR14","unstructured":"Hu, S., Ouyang, M., Gao, D., & Shou, M. Z. (2024). The dawn of gui agent: A preliminary case study with claude 3.5 computer use arXiv:2411.10323 arXiv preprint."},{"issue":"1","key":"3015_CR15","doi-asserted-by":"publisher","first-page":"22","DOI":"10.1186\/s40561-024-00310-z","volume":"11","author":"M Imran","year":"2024","unstructured":"Imran, M., & Almusharraf, N. (2024). Google gemini as a next generation ai educational tool: A review of emerging educational technology. Smart Learning Environments, 11(1), 22.","journal-title":"Smart Learning Environments"},{"key":"3015_CR16","unstructured":"Inan, H., Upasani, K., Chi, J., Rungta, R., Iyer, K., Mao, Y., Tontchev, M., Hu, Q., Fuller, B., Testuggine, D., & Khabsa, M. (2023). Llama guard: Llm-based input-output safeguard for human-ai conversations arXiv:2312.06674 arXiv preprint."},{"key":"3015_CR17","unstructured":"Jiang, A. Q., Sablayrolles, A., Mensch, A., Bamford, C., Chaplot, D. S., de las Casas, D., Bressand, F., Lengyel, G., Lample, G., Saulnier, L., et al. (2023). Mistral 7B. arXiv preprint arXiv:2310.06825."},{"key":"3015_CR18","doi-asserted-by":"crossref","unstructured":"Lee, S., Choi, J., Lee, J., Wasi, M. H., Choi, H., Ko, S., Oh, S., and Shin, I. (2024). Mobilegpt: Augmenting llm with human-like app memory for mobile task automation. In Proceedings of the 30th Annual International Conference on Mobile Computing and Networking, pages 1119\u20131133.","DOI":"10.1145\/3636534.3690682"},{"key":"3015_CR19","unstructured":"Lee, J., Hahm, D., Choi, J. S., Knox, W. B., and Lee, K. (2024). Mobilesafetybench: Evaluating safety of autonomous agents in mobile device control. arXiv preprint arXiv:2410.17520."},{"key":"3015_CR20","unstructured":"Lee, H., Phatale, S., Mansoor, H., Mesnard, T., Ferret, J., Lu, K., Bishop, C., Hall, E., Carbune, V., & Rastogi, A. (2023). Rlaif vs. rlhf: Scaling reinforcement learning from human feedback with ai feedback arXiv:2309.00267 arXiv preprint."},{"key":"3015_CR21","doi-asserted-by":"crossref","unstructured":"Li, C., Gan, Z., Yang, Z., Yang, J., Li, L., Wang, L., Gao, J., et\u00a0al. (2024). Multimodal foundation models: From specialists to general-purpose assistants. Foundations and Trends\u00ae in Computer Graphics and Vision, 16(1-2):1\u2013214, 2024.","DOI":"10.1561\/0600000110"},{"key":"3015_CR22","unstructured":"Li, X., Liang, S., Zhang, J., Fang, H., Liu, A., and Chang, E-C. (2024). Semantic mirror jailbreak: Genetic algorithm based jailbreak prompts against open-source llms. arXiv preprint arXiv:2402.14872."},{"key":"3015_CR23","doi-asserted-by":"crossref","unstructured":"Liang, PP., Goindani, A, Chafekar, T., Mathur, L., Yu, H., Salakhutdinov, R., and Morency, L-P. (2024). Hemm: Holistic evaluation of multimodal foundation models. arXiv preprint arXiv:2407.03418.","DOI":"10.52202\/079017-1358"},{"key":"3015_CR24","doi-asserted-by":"crossref","unstructured":"Liang, S., Liu, J., Zhai, J., Fang, T., Tu, R., Liu, A., Cao, X., and Tao, D. (2025). T2vshield: Model-agnostic jailbreak defense for text-to-video models. arXiv preprint arXiv:2504.15512.","DOI":"10.1007\/s11263-025-02724-9"},{"key":"3015_CR25","unstructured":"Liu, A., Feng, B., Xue, B., Wang, B., Wu, B., Lu, C., Zhao, C., Deng, C., Zhang, C., & Ruan, C. (2024). Deepseek-v3 technical report arXiv:2412.19437 arXiv preprint."},{"key":"3015_CR26","unstructured":"Liu, X., Xu, N., Chen, M., and Xiao, C. (2023). Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451."},{"key":"3015_CR27","doi-asserted-by":"crossref","unstructured":"Liu, G., Zhao, P., Liang, Y., Liu, L., Guo, Y., Xiao, H., Lin, W., Chai, Y., Han, Y., Ren, S., et al. (2025). LLM-Powered GUI Agents in Phone Automation: Surveying Progress and Prospects. Transactions on Machine Learning Research. arXiv:2504.19838.","DOI":"10.20944\/preprints202501.0413.v1"},{"key":"3015_CR28","unstructured":"Lu, L., Pang, S., Liang, S., Zhu, H., Zeng, X., Liu, A., Liu, Y., and Zhou, Y.. Adversarial training for multimodal large language models against jailbreak attacks. arXiv preprint arXiv:2503.04833, 2025."},{"key":"3015_CR29","doi-asserted-by":"crossref","unstructured":"Ma, X., Zhang, Z., & Zhao, H. (2024). Coco-agent: A comprehensive cognitive mllm agent for smartphone gui automation arXiv:2402.11941 arXiv preprint.","DOI":"10.18653\/v1\/2024.findings-acl.539"},{"key":"3015_CR30","unstructured":"Meta. (2025). Llama Guard 4 Model Card. Hugging Face. https:\/\/huggingface.co\/meta-llama\/Llama-Guard-4-12B."},{"key":"3015_CR31","doi-asserted-by":"crossref","unstructured":"Naghipour Vijouyeh, L., Bruno, R., and Ferreira, P. (2024). Emulation tool for android edge devices. In Proceedings of the 2024 IEEE\/ACM 46th International Conference on Software Engineering: Companion Proceedings, pages 109\u2013113, 2024.","DOI":"10.1145\/3639478.3640039"},{"key":"3015_CR32","unstructured":"Naveed, H., Khan, A.U., Qiu, S., Saqib, M., Anwar, S., Usman, M., Akhtar, N., Barnes, N., and Mian, A. (2023). A comprehensive overview of large language models. arXiv preprint arXiv:2307.06435."},{"key":"3015_CR33","unstructured":"OpenAI. (2024). GPT-4o System Card. arXiv preprint arXiv:2410.21276."},{"key":"3015_CR34","unstructured":"Robey, A., Wong, E., Hassani, H., and Pappas, G. J. (2023). Smoothllm: Defending large language models against jailbreaking attacks. arXiv preprint arXiv:2310.03684."},{"key":"3015_CR35","unstructured":"Team, G., Anil, R., Borgeaud, S., Alayrac, J-B., Yu, J., Soricut, R., Schalkwyk, J., Dai, A.M., Hauth, A., Millican, K., et\u00a0al. (2023). Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805."},{"key":"3015_CR36","unstructured":"Team, G., Mesnard, T., Hardin, C., Dadashi, R., Bhupatiraju, S., Pathak, S., Sifre, L., Rivi\u00e8re, M., Kale, M.S., Love, J., et\u00a0al. (2024). Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.08295."},{"key":"3015_CR37","doi-asserted-by":"crossref","unstructured":"Wang, J., Xu, H., Jia, H., Zhang, X., Yan, M., Shen, W., Zhang, J., Huang, F., and Sang, J. (2024). Mobile-agent-v2: Mobile device operation assistant with effective navigation via multi-agent collaboration. arXiv preprint arXiv:2406.01014.","DOI":"10.52202\/079017-0088"},{"key":"3015_CR38","doi-asserted-by":"crossref","unstructured":"Wang, W., Yu, Z., Liu, W., Ye, R., Jin, T., Chen, S., and Wang, Y. (2025). Fedmobileagent: Training mobile agents using decentralized self-sourced data from diverse users. arXiv preprint arXiv:2502.02982.","DOI":"10.18653\/v1\/2025.hcinlp-1.8"},{"key":"3015_CR39","doi-asserted-by":"crossref","unstructured":"Wen, H., Li, Y., Liu, G., Zhao, S., Yu, T., Toby Jia-Jun Li, Jiang, S., Liu, Y., Zhang, Y., and Liu, Y. (2024). Autodroid: Llm-powered task automation in android. In Proceedings of the 30th Annual International Conference on Mobile Computing and Networking, pages 543\u2013557.","DOI":"10.1145\/3636534.3649379"},{"key":"3015_CR40","unstructured":"Wen, H., Wang, H., Liu, J., & Li, Y. (2023). Droidbot-gpt: Gpt-powered ui automation for android arXiv:2304.07061 arXiv preprint."},{"key":"3015_CR41","unstructured":"Wu, L., Wang, C., Liu, T., Zhao, Y., and Wang, H. (2025)From assistants to adversaries: Exploring the security risks of mobile llm agents. arXiv preprint arXiv:2505.12981."},{"key":"3015_CR42","doi-asserted-by":"crossref","unstructured":"Wu, J., Yin, W., Jiang, Y., Wang, Z., Xi, Z., Fang, R., Zhang, L., He, Y., Zhou, D., Xie, P., et\u00a0al. (2025). Webwalker: Benchmarking llms in web traversal. arXiv preprint arXiv:2501.07572.","DOI":"10.18653\/v1\/2025.acl-long.508"},{"key":"3015_CR43","doi-asserted-by":"crossref","unstructured":"Xie, T., Zhang, D., ChenJ., Li, X., Zhao, S., Cao, R., Hua, T.J., Cheng, Z., Shin, D., Lei, F., et\u00a0al. (2024). Osworld: Benchmarking multimodal agents for open-ended tasks in real computer environments. Advances in Neural Information Processing Systems, 37:52040\u201352094.","DOI":"10.52202\/079017-1650"},{"issue":"12","key":"3015_CR44","doi-asserted-by":"publisher","first-page":"1486","DOI":"10.1038\/s42256-023-00765-8","volume":"5","author":"Y Xie","year":"2023","unstructured":"Xie, Y., Yi, J., Shao, J., Curl, J., Lyu, L., Chen, Q., Xie, X., & Wu, F. (2023). Defending ChatGPT against jailbreak attack via self-reminders. Nature Machine Intelligence, 5(12), 1486\u20131496.","journal-title":"Nature Machine Intelligence"},{"key":"3015_CR45","unstructured":"Xu, S., Fu, W., Gao, J., Ye, W., Liu, W., Mei, Z., Wang, G., Yu, C., & Wu, Y. (2024). Is dpo superior to ppo for llm alignment? a comprehensive study arXiv:2404.10719 arXiv preprint."},{"key":"3015_CR46","unstructured":"Yang, Y., Yang, X., Li, Chenhao, S. Lin, Zhao, Z., Shen, C., and Zhang, T. (2024). Security matrix for multimodal agents on mobile devices: A systematic and proof of concept study. arXiv preprint arXiv:2407.09295."},{"key":"3015_CR47","unstructured":"Yang, A., Yang, B., Zhang, B., Hui, B., Zheng, B., Yu, B., Li, C., Liu, D., Huang, F., Wei, H., et al. (2024). Qwen2.5 Technical Report. arXiv preprint arXiv:2412.15115."},{"key":"3015_CR48","doi-asserted-by":"publisher","first-page":"20744","DOI":"10.52202\/068431-1508","volume":"35","author":"S Yao","year":"2022","unstructured":"Yao, S., Chen, H., Yang, J., & Narasimhan, K. (2022). Webshop: Towards scalable real-world web interaction with grounded language agents. Advances in Neural Information Processing Systems, 35, 20744\u201320757.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"3015_CR49","doi-asserted-by":"crossref","unstructured":"Ying, Z., Liu, A., Zhang, T., Yu, Z., Liang, S., Liu, X., and Tao, D. (2024). Jailbreak vision language models via bi-modal adversarial prompt. arXiv preprint arXiv:2406.04031.","DOI":"10.1109\/TIFS.2025.3583249"},{"key":"3015_CR50","doi-asserted-by":"crossref","unstructured":"Ying, Z., Zhang, D., Jing, Z., Xiao, Y., Zou, Q., Liu, A., Liang, S., Zhang, X., Liu, X., and Tao, D. (2025). Reasoning-augmented conversation for multi-turn jailbreak attacks on large language models. arXiv preprint arXiv:2502.11054.","DOI":"10.18653\/v1\/2025.findings-emnlp.929"},{"key":"3015_CR51","unstructured":"Zhang, D., Shen, Z., Xie, R., Zhang, S., Xie, T., Zhao, Z., Chen, S., Chen, L., Xu, H., Cao, R., et\u00a0al. (2023). Mobile-env: Building qualified evaluation benchmarks for llm-gui interaction. arXiv preprint arXiv:2305.08144, 2023."},{"key":"3015_CR52","doi-asserted-by":"crossref","unstructured":"Zhang, C., Yang, Z., Liu, J., Li, Y., Han, Y., Chen, X., Huang, Z., Fu, B., and Yu, G. (2025). Appagent: Multimodal agents as smartphone users. In Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems, pages 1\u201320.","DOI":"10.1145\/3706598.3713600"},{"key":"3015_CR53","unstructured":"Zhang, J., Zhao, C., Zhao, Y., Yu, Z., He, M., and Fan, J. (2024). Mobileexperts: A dynamic tool-enabled agent team in mobile devices. arXiv preprint arXiv:2407.03913."},{"key":"3015_CR54","unstructured":"Zhang, J., Yin, L., Zhou, Y., & Hu, S. (2025). Agentalign: Navigating safety alignment in the shift from informative to agentic large language models arXiv:2505.23020 arXiv preprint."},{"key":"3015_CR55","unstructured":"Zhao, Y., Zheng, X., Luo, L., Li, Y., Ma, X., and Jiang, Y-G. (2024). Bluesuffix: Reinforced blue teaming for vision-language models against jailbreak attacks. arXiv preprint arXiv:2410.20971."},{"key":"3015_CR56","unstructured":"Zhou, Q., Li, T., Guo, Q., Wang, D., Lin, Y., Liu, Y., and Dong, J.S. (2024). Defending lvlms against vision attacks through partial-perception supervision. arXiv preprint arXiv:2412.12722."},{"key":"3015_CR57","doi-asserted-by":"crossref","unstructured":"Zhu, K., Wang, J., Zhou, J., Wang, Z., Chen, H., Wang, Y., Yang, L., Ye, W., Zhang, Y., Gong, N. Z., & Xie, X. (2023). PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts. arXiv preprint arXiv:2306.04528.","DOI":"10.1145\/3689217.3690621"}],"container-title":["International Journal of Computer Vision"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-026-03015-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11263-026-03015-7","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-026-03015-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,23]],"date-time":"2026-09-23T19:12:39Z","timestamp":1790190759000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11263-026-03015-7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,23]]},"references-count":57,"journal-issue":{"issue":"10","published-print":{"date-parts":[[2026,10]]}},"alternative-id":["3015"],"URL":"https:\/\/doi.org\/10.1007\/s11263-026-03015-7","relation":{},"ISSN":["0920-5691","1573-1405"],"issn-type":[{"value":"0920-5691","type":"print"},{"value":"1573-1405","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,23]]},"assertion":[{"value":"12 December 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"24 August 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"23 September 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"This study aims to enhance the jailbreak defense of mobile agents in open environments and to strengthen their reliability in real-world applications. While the research involves the analysis and generation of potentially harmful content, all such content is used solely for experimental and defense evaluation purposes, in full compliance with academic ethical standards, and is prohibited from any dissemination or misuse. We hope this work will provide theoretical foundations and methodological insights for future research on security assessment, adversarial testing, and defense development, thereby advancing mobile agents along a compliant and secure trajectory.","order":1,"name":"Ethics","label":"Ethical statement and broader impact","group":{"name":"EthicsHeading","label":"Declarations"}}],"article-number":"449"}}