Researchers uncover efficiency-based backdoor attacks on AI GUI agents

Researchers have identified a previously overlooked vulnerability in vision-language model (VLM) based graphical user interface agents: the ability to degrade their response speed without breaking their functional accuracy. A new attack dubbed SlowBA exploits this gap in security research.

The attack mechanism#

Traditional security research on GUI agents has concentrated on preventing incorrect actions or decisions. SlowBA takes a different angle, targeting response latency instead. The attack works by embedding hidden triggers—designed as realistic pop-up windows that naturally blend into typical interface environments—that cause the agent to generate excessively long reasoning chains when activated. This dramatically increases how long it takes the system to respond, even while the final action remains correct.

Technical approach#

The researchers developed a two-stage reward-level backdoor injection method that first trains the agent to adopt the undesired long-response format, then uses reinforcement learning to link this behavior to specific triggers. The pop-up window triggers are particularly insidious because they appear legitimate within normal GUI workflows, making the attack hard to detect.

Implications and robustness#

Testing across multiple datasets and agent configurations demonstrated that SlowBA can substantially increase both response length and latency while preserving task accuracy—the agent still completes its assigned tasks correctly, just slowly. The vulnerability persists even when only a small fraction of training data is poisoned, and several existing defense mechanisms fail to mitigate it.

The work underscores a critical gap in current AI security practices: focusing on what an agent does while overlooking how fast it does it. Both aspects matter for reliable deployed systems.