MIRAGE: Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agents

The gist The proposed MIRAGE framework introduces a novel visual indirect prompt injection framework for targeted next-action hijacking in screenshot-based web agents under strict spatial constraints, demonstrating high efficacy and stealth.

Problem and Threat Model

Multimodal large language models (MLLMs) enable web agents that operate directly on rendered webpages by observing screenshots and predicting the next action required to complete a user task At the same time, it introduces a new security boundary: visual content rendered on a webpage is not merely shown to the user, but also becomes part of the agent’s decision-making context A particularly realistic risk arises when the website itself is trusted, but some bounded regions of the page are supplied by third parties This raises a practical security question: Can an adversary who controls only a legitimate bounded visual region steer a web agent toward an attacker-chosen next action Existing attacks on web agents do not fully capture this setting

MIRAGE Framework and Methodology

To overcome these challenges, the authors introduce MIRAGE (Masked Injection via Residual And Generative Exploitation), a masked, diffusion-guided visual prompt injection framework The method operationalizes a global evasion via Local Attention Collapse strategy to achieve high attack efficacy under severe spatial constraints This approach integrates a fully differentiable compositing pipeline that jointly optimizes pixel-level residual perturbations and semantic-level latent manipulations The framework executes visual prompt injection by formulating an adversarial optimization problem over a localized diffusion generation process

Key Components of MIRAGE

The attack pipeline involves several sophisticated components designed to ensure both semantic manipulation and visual plausibility

1. Semantic-level Latent Manipulation: The method leverages the reverse diffusion process to modify the image at the semantic level This involves using a partial forward diffusion process, injecting controlled Gaussian noise up to a specific timestep τT, where τ = 0.3

2. Reverse Sampling via DDIM Trajectory: The reverse sampling process is initialized from zT and iteratively refined using the gradient of the MLLM task loss To enhance targeted action control, an Enhanced DDIM Curvature Objective is introduced to drive the sampling trajectory into out-ofdistribution areas The latent update is guided by zˆt−1 = zt−1 − η∇zt(Ltask(zt, yˆ) − λ1Lcurve)

3. Synergistic Dark-Pixel Residual Perturbation and Compositing: A fully differentiable compositing pipeline is used to compute the composite input xˆ with Eq. 15 This involves injecting a sparse residual perturbation δ, which is restricted to the dark pixels of the visual context defined by Mdark The final composite adversarial patch pˆ is computed as pˆ = pbase + Mdark ⊙ δ

Evaluation and Results

Extensive experiments were conducted against prominent MLLM web agent frameworks, specifically SeeAct and OpenClaw The evaluation utilized the realworld Mind2Web dataset, filtering for tasks requiring CLICK or SELECT actions MIRAGE achieved state-of-the-art performance, consistently outperforming existing baselines on the real-world dataset across various MLLM architectures Table 1 shows that MIRAGE achieves an ASR of 95.7 for SeeAct and 98.3 for OpenClaw The results demonstrate that the synergistic combination of semantic-level and pixel-level perturbations manipulates the MLLM’s attention far more effectively than gradient-based noise alone

Limitations and Future Work

While MIRAGE achieves state-of-the-art performance under a practical threat model, several limitations remain to be addressed First, the framework incurs computational overhead due to the reliance on iterative PGD for sparse pixel-level perturbations Second, MIRAGE currently assumes white-box access to the target model’s gradients, which restrains its effectiveness against closedsource MLLMs Future work will focus on refining the adversarial diffusion sampling process to reduce the necessity of these pixel-level adjustments Additionally, the authors plan to enhance the transferability of MIRAGE to broader settings by simulating diverse MLLM patch segmentation strategies

Conclusion

Our proposed method achieves a highly effective balance between human-imperceptible stealth and adversarial efficacy, extending the applicability of these attacks to legitimate, bounded regions within trusted web platforms This combination of trusted-platform assumptions, bounded visual control, diffusion-guided synthesis, and action-level evaluation defines the gap addressed by our method MIRAGE provides a practical visual prompt injection framework under the malicious third-party threat model The findings contribute to the advancement of multimodal web agent security and provide valuable insights into achieving global attention collapse via localized visual manipulation MIRAGE could potentially be exploited by adversaries to manipulate commercial traffic and illicitly generate profit on trusted websites by hijacking web agents powered by open-source MLLMs Given the growing adoption of generalist web agents such as OpenClaw, these localized visual prompt injections pose a significant security threat to end-users Therefore, users should implement a human-in-the-loop verification mechanism, explicitly authorizing critical agent actions rather than relying on fully unsupervised web automation MIRAGE could potentially be exploited by adversaries to manipulate commercial traffic and illicitly generate profit on trusted websites by hijacking web agents powered by open-source MLLMs Given the growing adoption of generalist web agents such as OpenClaw, these localized visual prompt injections pose a significant security threat to end-users Therefore, users should implement a human-in-the-loop verification mechanism, explicitly authorizing critical agent actions rather than relying on fully unsupervised web automation MIRAGE could potentially be exploited by adversaries to manipulate commercial traffic and illicitly generate profit on trusted websites by hijacking web agents powered by open-source MLLMs Given the growing adoption of generalist web agents such as OpenClaw, these localized visual prompt injections pose a significant security threat to end-users Therefore, users should implement a human-in-the-loop verification mechanism, explicitly authorizing critical agent actions rather than relying on fully unsupervised web automation MIRAGE could potentially be exploited by adversaries to manipulate commercial traffic and illicitly generate profit on trusted websites by hijacking web agents powered by open-source MLLMs Given the growing adoption of generalist web agents such as OpenClaw, these localized visual prompt injections pose a significant security threat to end-users Therefore, users should implement a human-in-the-loop verification mechanism, explicitly authorizing critical agent actions rather than relying on fully unsupervised web automation MIRAGE could potentially be exploited by adversaries to manipulate commercial traffic and illicitly generate profit on trusted websites by hijacking web agents powered by open-source MLLMs Given the growing adoption of generalist web agents such as OpenClaw, these localized visual prompt injections pose a significant security threat to end-users Therefore, users should implement a human-in-the-loop verification mechanism, explicitly authorizing critical agent actions rather than relying on fully unsupervised web automation MIRAGE could potentially be exploited by adversaries to manipulate commercial traffic and illicitly generate profit on trusted websites by hijacking web agents

1. The improved system can perform targeted next-action hijacking on trusted web platforms by exploiting semantically legitimate, spatially constrained regions controlled by a third party, as described in MIRAGE: Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agents. This is achieved by leveraging a masked diffusion-guided visual prompt injection framework that combines diffusion-constrained visual synthesis with sparse dark-pixel residual perturbations for targeted next-action hijacking under strict spatial constraints.

2. The system can achieve high attack efficacy while maintaining visual stealth by employing a synergistic combination of semantic and pixel-level perturbations, which the paper states manipulates the MLLM’s attention far more effectively than gradient-based noise alone. This allows for attacks that are significantly higher realism compared to methods like WebInject, which uses full-screen gradient-based noise.

3. The system can steer web agents to execute specific, attacker-chosen actions by optimizing the diffusion latent under a loss function that balances task success with visual fidelity, as detailed by the objective: zˆt−1 = zt−1 − η∇zt(Ltask(zt, yˆ) − λ1Lcurve). This ensures the generated content aligns with the attacker’s objectives while avoiding convergence to suboptimal local minima.

4. The system can generate adversarial patches that are robust against detection by restricting pixel-level perturbations to regions that are inherently less sensitive to human visual perception: the dark pixels of the visual context, as defined by isolating pixels based on their relative luminance and constructing a boolean mask Mdark to restrict the perturbation strictly to the darkest 30% of these valid pixels.