SlowBA: Efficiency Backdoor for GUI Agents

• SlowBA is a backdoor attack that targets efficiency in GUI agents, triggering long reasoning chains without altering action correctness.
• It employs a two-stage reward-level injection strategy, using realistic GUI pop-up triggers to selectively induce excessive response lengths.
• Empirical results on web, desktop, and Android benchmarks show marked increases in latency and energy consumption with minimal impact on task accuracy.

SlowBA is a backdoor attack against vision-language-model-based graphical user interface agents that targets response efficiency rather than action correctness. The attack seeks to preserve normal behavior on clean inputs while causing very high latency on triggered inputs by inducing excessively long reasoning chains under specific visual trigger patterns. In the formulation reported for GUI agents, a backdoored agent $\mathcal{F}_{bd}$ is expected to retain high accuracy and low latency on clean screenshots $(x,q)$, but to become slow when a small visual trigger $t$ is added to the screenshot, yielding $(x \oplus t, q)$ (Li et al., 9 Mar 2026). The work introduces a two-stage reward-level backdoor injection strategy, uses realistic pop-up windows as triggers, and evaluates the attack on web, desktop, and Android GUI benchmarks.

1. Threat model and problem formulation

SlowBA is presented as the first backdoor attack that targets efficiency rather than correctness in VLM-based GUI agents (Li et al., 9 Mar 2026). The setting assumes a GUI agent that must not only produce correct actions such as clicks, typing, or scrolling, but must do so with low latency. The core objective is to preserve the agent’s normal performance on clean screenshots while making it respond much more slowly in the presence of a trigger.

The idealized search problem is stated as

$$\theta^* = \arg\max_{\theta} \mathbb{E}_{(x,q)\sim\mathcal{D}}\bigl[\mathrm{Latency}\bigl(\mathcal{F}_{bd}(x\oplus t,q)\bigr)\bigr] \quad \text{s.t.} \quad \begin{cases} \mathrm{Acc}\bigl(\mathcal{F}_{bd}(x,q)\bigr)\approx \mathrm{Acc}\bigl(\mathcal{F}(x,q)\bigr),\ \mathrm{Acc}\bigl(\mathcal{F}_{bd}(x\oplus t,q)\bigr)\approx \mathrm{Acc}\bigl(\mathcal{F}(x,q)\bigr). \end{cases}$$

Because latency is difficult to optimize directly, the paper reports a strong empirical correlation between response length and latency, with Pearson $r = 0.8059$, and therefore reduces the optimization target to response length on triggered inputs (Li et al., 9 Mar 2026). In operational terms, the attack does not primarily attempt to alter the semantic correctness of the final action. Instead, it inflates the reasoning chain preceding that action.

This framing distinguishes SlowBA from prior backdoor attacks cited in the work, including VisualTrap, TrojVLM, and BadToken, which are described as aiming to force wrong actions or mistaken grounding. A central implication is that conventional evaluations focused on action accuracy can miss a degradation channel that is expressed through runtime and resource consumption rather than overt task failure. This suggests a threat model in which service-level performance can be compromised while standard correctness-oriented audits still appear acceptable.

2. Trigger construction and stealth properties

The trigger $t$ is designed as a realistic GUI pop-up window rather than an obviously artificial patch (Li et al., 9 Mar 2026). Examples given in the description include notification dialogs such as “site wants to show notifications” and “system update ready,” placed unobtrusively at a corner of the screenshot. The triggered image is written as $x \oplus t$, and no structural change is made to the user query $q$.

The trigger design is specialized to the GUI environment. On web pages, the system automatically extracts the domain via Qwen3-VL and renders a believable browser notification such as “github.com would like to….” On desktop or mobile app screenshots, it renders familiar OS update or permission dialogs. The paper’s rationale is that such pop-ups are ubiquitous and benign enough that end users rarely question a small notification panel.

Stealth is reinforced by limited poisoning. The reported training setup injects such triggers into only $10\%$ of the training images while maintaining stealth (Li et al., 9 Mar 2026). Human judges rate the pop-ups as “normal” more than $(x,q)$0 of the time, with Fleiss’ $(x,q)$1, and trigger injection is reported to take less than $(x,q)$2 seconds per image. These observations matter because the attack depends on the trigger being both effective and visually plausible within ordinary GUI workflows.

A common misconception is that backdoor triggers in multimodal systems must be visually conspicuous or semantically unrelated to the task. SlowBA directly contests that assumption by embedding the trigger in commonplace interface artifacts. A plausible implication is that GUI-specific realism can materially strengthen backdoor stealth relative to generic image-space perturbations.

3. Two-stage reward-level backdoor injection

The central method is a two-stage reward-level backdoor injection (RBI) strategy (Li et al., 9 Mar 2026). The first stage aligns the model to a long-response format; the second stage makes that behavior trigger-aware through reinforcement learning.

Stage I: Response-Format Alignment

Stage I is a supervised fine-tuning stage whose goal is to teach the agent how to produce a coherent long reasoning chain before the final action without disturbing action accuracy. The triggered training set is denoted $(x,q)$3, where $(x,q)$4 is a long but action-correct answer generated by Qwen3-VL. The loss is

$(x,q)$5

This stage establishes a response format rather than a trigger-conditioned policy boundary. The ablations reported later show that Stage I alone produces long answers on all inputs, which is undesirable for a selective backdoor.

Stage II: Trigger-Aware Activation

Stage II merges clean examples $(x,q)$6 and triggered examples $(x,q)$7, and optimizes a reward that rewards length on triggered inputs while penalizing excessive length on clean inputs. The reward is defined as

$(x,q)$8

with $(x,q)$9, $t$0, and $t$1.

The optimization uses GRPO, described as a PPO-style group-relative reinforcement-learning method. The description states that the update increases length only for triggered inputs while keeping the clean-input policy close to the Stage I reference policy $t$2 (Li et al., 9 Mar 2026). The paper’s interpretation is that this decoupling confines the policy shift to answer length and avoids rewarding incorrect clicks.

The ablation study is structurally important. Stage I only leads to long answers on all inputs; Stage II only yields unstable behavior, sometimes long on both triggered and clean inputs and sometimes collapsing; using both stages yields clear separation, with only triggered inputs receiving very long answers. That result supports the claim that the attack depends on a division between format alignment and trigger-specific activation rather than on either component in isolation.

4. Experimental setting and evaluation protocol

The experiments are conducted with GUI-R1 built on Qwen2.5-VL, mostly using the 3B-parameter version (Li et al., 9 Mar 2026). The benchmarks cover three interface domains: OmniAct-Web plus GUI-Act-Web for web, ScreenSpot-Pro for desktop, and AndroidControl-Low for Android.

The comparison set includes four baselines: Gaussian Noise, JPEG Compression, Verbose Image, and VisualTrap. Gaussian Noise and JPEG Compression are treated as input corruption baselines. Verbose Image is described as a white-box VLM-latency attack. VisualTrap is an existing backdoor for mis-grounding that is adapted to this setting.

The evaluation uses increases in length, latency, and energy, alongside clean and triggered action accuracy. The reported metrics are

$t$3

$t$4

$t$5

Triggered Acc and Clean Acc are the standard GUI-R1 action-accuracy measures, defined in the description as click type plus coordinates or text F1. The inclusion of energy alongside latency is notable because it treats the attack as a resource-consumption threat as well as an interaction-delay threat. This suggests a broader systems perspective in which a successful backdoor can degrade throughput and efficiency without necessarily causing conspicuous task errors.

5. Empirical results across web, desktop, and Android

On the web subset, SlowBA substantially increases response length, latency, and energy while largely preserving action accuracy relative to the clean baseline (Li et al., 9 Mar 2026).

Metric	Value	Context
I-length	358.52%	Web
I-latency	66.92%	Web
I-energy	65.41%	Web
Clean Acc	63.1	orig 67.5
Triggered Acc	49.3	Web

The non-backdoor baselines perform very differently. The best non-backdoor baselines have $t$6-latency below $t$7, often negative, and Verbose Image reportedly reduces latency by generating fewer tokens. VisualTrap gives almost zero length increase. Within the reported setup, this indicates that SlowBA is not simply exploiting generic image corruption or a preexisting tendency toward verbosity.

The pattern extends beyond the web domain. On desktop, SlowBA yields more than $t$8 latency increase; on Android, it yields more than $t$9 latency increase, while clean and triggered accuracy barely change, within a few percentage points (Li et al., 9 Mar 2026). The paper therefore treats the attack as cross-domain within the tested GUI settings rather than as a web-specific artifact.

The contrast between large latency inflation and relatively stable task accuracy is central. A common assumption in evaluation is that stronger attacks must manifest as obvious correctness degradation. SlowBA shows that this need not hold: the policy can remain action-competent while becoming operationally inefficient. That dissociation is one of the paper’s principal empirical findings.

6. Robustness, defenses, and implications

The paper reports that SlowBA remains effective under several defenses (Li et al., 9 Mar 2026). It is described as robust to the backdoor detectors Spectral Signature and Beatrix, as well as to mean filtering, median filtering, JPEG sanitization, and model quantization. Under these settings, the latency increase reportedly drops only by a few percent.

This robustness is important because the trigger is designed to resemble a normal UI element rather than an anomalous perturbation. Standard defenses aimed at identifying poisoned samples or sanitizing suspicious pixels may therefore have limited effect. The paper consequently argues that efficiency backdoors constitute a distinct threat dimension and that defenses should monitor both correctness and latency-length profiles.

The discussion section emphasizes why accuracy is preserved: by decoupling the alignment of a long-form answer in Stage I from the triggered activation in Stage II, and by never rewarding incorrect clicks, the method confines the policy shift to answer length. In practical terms, the work gives the example of automated train-ticket booking, where a delay of $(x \oplus t, q)$0 seconds versus $(x \oplus t, q)$1 seconds can cause time-out failures or missed bookings. The example is not a universal benchmark result, but it illustrates the type of real-world consequence that can arise when an agent remains mostly correct yet becomes substantially slower.

The proposed future defenses in the paper include joint monitoring of correctness and latency-length profiles, trigger-aware sanitization of GUI screenshots, and adversarial training that penalizes unnatural length jumps (Li et al., 9 Mar 2026). These are presented as directions rather than validated solutions. A plausible implication is that protecting GUI agents may require treating deliberation length itself as a security-sensitive output channel.

7. Position within GUI-agent security research

SlowBA broadens the scope of GUI-agent security by identifying response efficiency as an attack target in its own right (Li et al., 9 Mar 2026). Earlier work discussed in the paper centers on forcing incorrect actions or mis-grounding. SlowBA instead preserves correct actions while dramatically inflating the reasoning chain and runtime. That distinction matters because it shifts attention from semantic integrity alone to end-to-end interaction performance.

The work also contributes a methodological pattern: first teach a long-answer format, then use reinforcement learning to activate that format only when a trigger is present. Within the paper’s evidence, this separation is what makes the backdoor selective rather than globally verbose. The result is an attack that is simultaneously stealthy, effective at increasing latency, and comparatively stable across multiple interface domains.

For the study of multimodal agents, SlowBA underscores that safety and security cannot be reduced to whether an agent clicks the right element or generates the right text. Efficiency, latency, and energy consumption can themselves become adversarially manipulated outputs. The paper’s broader significance lies in making that dimension explicit and in showing that realistic GUI artifacts can serve as triggers for such manipulation. Code availability is reported at the project repository linked from the arXiv paper (Li et al., 9 Mar 2026).