CORA: Conformal Risk-Controlled Agents for Safeguarded Mobile GUI Automation
2026-04-10 • Machine Learning
Machine LearningArtificial Intelligence
AI summaryⓘ
The authors created CORA, a safety system for computer programs that control apps by looking and talking (vision language models). CORA checks each action the program wants to do and decides if it's risky or safe, using a special method that balances safety and usefulness. If an action seems risky, another part of CORA helps figure out what to do next, like asking the user for confirmation. They tested CORA on a new phone safety benchmark and found it better at avoiding harmful actions while still helping the user effectively.
Graphical User Interface (GUI)Vision Language Models (VLMs)Conformal Risk ControlAutonomous AgentsSafety in AIPost-policy SafeguardingMultimodal ReasoningUser IntentRisk EstimationBenchmarking
Authors
Yushi Feng, Junye Du, Qifan Wang, Zizhan Ma, Qian Niu, Yutaka Matsuo, Long Feng, Lequan Yu
Abstract
Graphical user interface (GUI) agents powered by vision language models (VLMs) are rapidly moving from passive assistance to autonomous operation. However, this unrestricted action space exposes users to severe and irreversible financial, privacy or social harm. Existing safeguards rely on prompt engineering, brittle heuristics and VLM-as-critic lack formal verification and user-tunable guarantees. We propose CORA (COnformal Risk-controlled GUI Agent), a post-policy, pre-action safeguarding framework that provides statistical guarantees on harmful executed actions. CORA reformulates safety as selective action execution: we train a Guardian model to estimate action-conditional risk for each proposed step. Rather than thresholding raw scores, we leverage Conformal Risk Control to calibrate an execute/abstain boundary that satisfies a user-specified risk budget and route rejected actions to a trainable Diagnostician model, which performs multimodal reasoning over rejected actions to recommend interventions (e.g., confirm, reflect, or abort) to minimize user burden. A Goal-Lock mechanism anchors assessment to a clarified, frozen user intent to resist visual injection attacks. To rigorously evaluate this paradigm, we introduce Phone-Harm, a new benchmark of mobile safety violations with step-level harm labels under real-world settings. Experiments on Phone-Harm and public benchmarks against diverse baselines validate that CORA improves the safety--helpfulness--interruption Pareto frontier, offering a practical, statistically grounded safety paradigm for autonomous GUI execution. Code and benchmark are available at cora-agent.github.io.