Android GUI 代理能否抵禦運行時異常？AnTrap：在動態對抗環境中評估代理

摘要

GUI智能體在Android裝置上部署時經常遭遇動態異常，從意外的彈出視窗到動作誤用，然而現有基準測試缺乏對智能體面對執行期異常時魯棒性的系統性評估。我們引入AnTrap，一個將動態擾動注入智能體執行軌跡的綜合基準測試。我們提出一個分類框架，將真實世界的異常組織為四個層級（狀態、思考、動作和回合），包含十個細粒度子類別，並開發了一條構建流程，在保留任務可解性的同時引入現實的對抗性條件。通過評估16個領先的GUI模型，我們揭示了對動態異常的普遍脆弱性，即使是目前最強的模型也遭受顯著的效能下降。此外，我們在原始環境和對抗性環境中進行GRPO訓練以驗證我們的基準測試，將環境可學習的異常與推理瓶頸型異常區分開來。研究結果表明，雖然狀態層和動作層的單步陷阱在很大程度上可以通過對抗性強化學習來解決，但深層語境陷阱，例如狀態死鎖，則暴露出僅靠在有陷阱的環境中訓練無法克服的內在局限性。

English

GUI agents often encounter dynamic anomalies when deployed on Android devices, from unexpected pop-ups to action misuse, yet existing benchmarks lack systematic evaluation of agent robustness against runtime anomalies. We introduce AnTrap, a comprehensive benchmark that injects dynamic perturbations into agent execution trajectories. We propose a taxonomy organizing real-world anomalies into four layers (State, Thinking, Action and Round) with ten fine-grained subcategories, and develop a construction pipeline that preserves task solvability while introducing realistic adversarial conditions. Evaluating 16 leading GUI models, we reveal universal vulnerability to dynamic anomalies, with even the strongest models suffering significant performance degradation. Furthermore, we conduct GRPO training in both original and adversarial environments to validate our benchmark, separating environment-learnable anomalies from reasoning-bottlenecked ones. Our findings show that while single-step traps at state and action layers are largely addressable through adversarial reinforcement learning, deep contextual traps, like state deadlock, expose intrinsic limitations that cannot be resolved by training in environments with traps alone.