标题： LaSM：用于防御GUI代理弹出攻击的逐层缩放机制 显示英文标题

标题： LaSM: Layer-wise Scaling Mechanism for Defending Pop-up Attack on GUI Agents

摘要： 图形用户界面（GUI）代理基于多模态大型语言模型（MLLMs），最近在基于屏幕的交互任务中表现出强大的决策能力。 然而，它们仍然极易受到基于弹窗的环境注入攻击，其中恶意视觉元素会分散模型的注意力，导致不安全或错误的操作。 现有的防御方法要么需要昂贵的重新训练，要么在归纳干扰下表现不佳。 在本工作中，我们系统地研究了此类攻击如何改变GUI代理的注意力行为，并揭示了正确和错误输出之间的逐层注意力差异模式。 基于这一见解，我们提出了\textbf{拉姆}，一种选择性地放大关键层中的注意力和 MLP 模块的\textit{逐层缩放机制}。 LaSM 在无需额外训练的情况下提高了模型显著性与任务相关区域之间的对齐度。 在12种弹窗扰动和4种不同模型主干的广泛实验中，LaSM始终提高了防御成功率。 当与提示级警报结合使用时，LaSM在强归纳攻击下仍能实现超过98%的鲁棒性。 我们的研究结果表明，注意力错位是MLLM代理的核心漏洞，可以通过选择性的逐层调制有效解决。 显示英文摘要

摘要： Graphical user interface (GUI) agents built on multimodal large language models (MLLMs) have recently demonstrated strong decision-making abilities in screen-based interaction tasks. However, they remain highly vulnerable to pop-up-based environmental injection attacks, where malicious visual elements divert model attention and lead to unsafe or incorrect actions. Existing defense methods either require costly retraining or perform poorly under inductive interference. In this work, we systematically study how such attacks alter the attention behavior of GUI agents and uncover a layer-wise attention divergence pattern between correct and incorrect outputs. Based on this insight, we propose \textbf{LaSM}, a \textit{Layer-wise Scaling Mechanism} that selectively amplifies attention and MLP modules in critical layers. LaSM improves the alignment between model saliency and task-relevant regions without additional training. Extensive experiments across 12 types of pop-up perturbations and 4 different model backbones show that LaSM consistently enhances the defense success rate. When combined with prompt-level alerts, LaSM achieves over 98\% robustness even under strong inductive attacks. Our findings reveal that attention misalignment is a core vulnerability in MLLM agents and can be effectively addressed through selective layer-wise modulation.