SA-CUA
A dual-LLM security framework for Computer Use Agents. It establishes a trust boundary by extracting deterministic rules from the accessibility tree and designs an endorsement channel that allows untrusted information to safely enter the trusted domain after verification, in order to defend against indirect prompt-injection attacks.
Timeline (last 90 days)
SA-CUA is a dual-LLM framework for establishing trust boundaries for computer-use Agents, whose core is to derive conservative deterministic rules from the accessibility tree, isolating trusted content from untrusted content on the privileged LLM's screenshot.
SA-CUA maintains a zero attack success rate while being far more practical than CaMeL-CUA.
SA-CUA designs an endorsement channel that allows values to pass from the untrusted domain to the trusted domain, but only on the premise that the information is verified through a trusted channel.
SA-CUA only requires human interaction at the start of a task to specify the task goal; once the task is launched, the Agent can run autonomously.
For some applications (especially games with custom-drawn UI and some desktop software), accessibility information is sparse or even missing; in such cases SA-CUA's rule derivation fails and it must fall back to other mechanisms.
SA-CUA is highly dependent on the quality and coverage of the accessibility tree; for applications or interfaces with incomplete accessibility information, the effectiveness of rule derivation needs further verification.
All Facts (6)
SA-CUA is a dual-LLM framework for establishing trust boundaries for computer-use Agents, whose core is to derive conservative deterministic rules from the accessibility tree, isolating trusted content from untrusted content on the privileged LLM's screenshot.
50%UnverifiedSA-CUA maintains a zero attack success rate while being far more practical than CaMeL-CUA.
50%UnverifiedSA-CUA designs an endorsement channel that allows values to pass from the untrusted domain to the trusted domain, but only on the premise that the information is verified through a trusted channel.
50%UnverifiedSA-CUA only requires human interaction at the start of a task to specify the task goal; once the task is launched, the Agent can run autonomously.
50%UnverifiedFor some applications (especially games with custom-drawn UI and some desktop software), accessibility information is sparse or even missing; in such cases SA-CUA's rule derivation fails and it must fall back to other mechanisms.
50%UnverifiedSA-CUA is highly dependent on the quality and coverage of the accessibility tree; for applications or interfaces with incomplete accessibility information, the effectiveness of rule derivation needs further verification.
50%