Intact ties browser actions to the webpage elements behind them
In plain words
A web agent may read a whole page as one block. That lets a misleading ad or other third-party text steer the agent toward actions on other parts of the page.
Intact is an architecture that keeps a record of who made each page element and what it can do, then checks each proposed action against the element it concerns.
In tests on 1,091 real webpages with inserted attacks, 12.8% of attacks got into Intact’s plans, compared with 73.1% for whole-page planning. An Intact step on a third-party element still needed the user’s consent, so a plan step did not mean the action happened.
The research
When a web agent reads a page as one block, third-party text can steer it to use the user’s authority on other page elements. How can an agent work with webpage content while ensuring each action stays tied to the element that prompted it?
Intact uses per-element authorship and capability records plus harness checks to constrain what an agent can do with webpage content.
Intact records who created or changed each webpage element and what it can do, then has a harness check proposed actions.
To test whether this constrains attacks, researchers instructed the same language model to follow injected text and compared one-element-at-a-time planning with whole-page planning.
On 1,091 attacked pages, attacks appeared in 12.8% of Intact plans, versus 73.1% of whole-page plans. Since third-party steps still required user consent, the result supports a claim about limiting attack effects, not eliminating attacks or automatically preventing every action.
These results concern one-page attacks from third-party content under the study’s assumptions, including that page scripts do not tamper with the instrumentation.
The functionality assessment judged whether selected elements supported a task; it did not execute plans to show whether tasks were completed.
Analysis
Deep
- Original paper authors
- Umar Iqbal
- Submitted to arXiv
- License
- CC BY 4.0