Android GUI代理能否抵御运行时异常？AnTrap：在动态对抗性环境中评估代理

摘要

GUI智能体在Android设备上部署时经常会遇到动态异常，从意外弹窗到动作误用，然而现有基准测试缺乏对智能体在运行时异常下鲁棒性的系统评估。我们提出了AnTrap，一个将动态扰动注入智能体执行轨迹的综合基准测试。我们提出了一种将现实世界异常组织为四层（状态层、思维层、动作层和回合层）共十个细粒度子类别的分类体系，并开发了一个在保留任务可解性的同时引入现实对抗条件的构建流程。通过评估16个领先的GUI模型，我们揭示了智能体对动态异常的普遍脆弱性，即使是最强的模型也遭受显著的性能下降。此外，我们在原始环境和对抗环境中进行了GRPO训练以验证我们的基准测试，将环境可学习的异常与推理瓶颈型异常区分开来。我们的研究结果表明，虽然状态层和动作层的单步陷阱在很大程度上可以通过对抗性强化学习来解决，但深层上下文陷阱，如状态死锁，暴露了仅通过在包含陷阱的环境中训练无法解决的内在局限性。

English

GUI agents often encounter dynamic anomalies when deployed on Android devices, from unexpected pop-ups to action misuse, yet existing benchmarks lack systematic evaluation of agent robustness against runtime anomalies. We introduce AnTrap, a comprehensive benchmark that injects dynamic perturbations into agent execution trajectories. We propose a taxonomy organizing real-world anomalies into four layers (State, Thinking, Action and Round) with ten fine-grained subcategories, and develop a construction pipeline that preserves task solvability while introducing realistic adversarial conditions. Evaluating 16 leading GUI models, we reveal universal vulnerability to dynamic anomalies, with even the strongest models suffering significant performance degradation. Furthermore, we conduct GRPO training in both original and adversarial environments to validate our benchmark, separating environment-learnable anomalies from reasoning-bottlenecked ones. Our findings show that while single-step traps at state and action layers are largely addressable through adversarial reinforcement learning, deep contextual traps, like state deadlock, expose intrinsic limitations that cannot be resolved by training in environments with traps alone.