Shanghai Innovation Institute and Fudan University Propose MATE: Policy-Aware Security Auditing for Mobile Agent Trajectories, Published at USENIX Security 2026

GUI agents differ from text-only models: they open apps, click buttons, read pages, forward messages, download files, and move information across apps, and risks often only surface after multiple steps. Each individual step looks reasonable, but combined they may already have crossed the line.

More troublesome is that the actions themselves lack clear semantics. The same click, type, or swipe means completely different things in different apps, different page states, different user goals, and different rules: a "click link" may just open a normal webpage, or it may enter a malicious download page; a "forward message" may be a user-authorized share, or it may make the Agent a relay for spreading scams or malicious content. What truly determines risk is the context in which the action occurs.

This explains why the object of auditing must expand from the "final output" to the "complete execution trajectory." Only by preserving the behavior-chain context across steps, pages, and apps does the security system have a chance to discover problems where "every step looks reasonable, but combined they have already crossed the line."

MATE hands "task instruction + execution trajectory + natural language security rules" together to a specially trained lightweight auditing model to judge whether this trajectory violates the given rules. The most critical point is that security rules are not hard-coded into model parameters, but exist as editable text, allowing users to customize security boundaries according to the scenario.

This means the same behavior trajectory can yield different conclusions under different security rules. When app providers update policies, organizations adjust permission boundaries, or users add personal constraints, there is no need to retrain the model just to change security boundaries. The paper positions it as the first model for "rule-aware" security auditing of mobile/GUI agent execution trajectories; this "first" claim is the team's own statement and has not yet been independently verified by third parties.

The output is also not a binary label, but three parts: violation judgment (Violation), risk category (Category), and explanation grounded in trajectory evidence (Rationale). For security auditing, "why it was judged a violation" is just as important as "whether the judgment is correct," because manual review, rule revision, incident tracing, and compliance proof all require an evidence chain that humans can read and re-verify.