GUI 智能体自报成功可能是假阳性，报告-轨迹审计可拦截
Who Verifies the Agent's Success Claim? Self-Report Leakage in GUI-Agent Completion Judging
GUI 智能体嘴上说完成但轨迹不支持，这论文教你怎么用独立审计拦住这类假成功，还给了具体拦截率数据。
论文提出 report-trace auditing，用独立记录的执行轨迹核查 GUI 智能体的完成声明。aware/blind 对照实验显示自我报告会泄漏到判定：隐藏自报后，Qwen3.5-35B-A3B 的危险误报召回率提升 43.4 个百分点，DeepSeek-284B-A13B 提升 13.3 个百分点。结构化审计器将声明解释与无声明轨迹分析分离，在 465 条审计目标集上达到 F1 0.75-0.78。启用审计门控后，在 45-56% 的检查负载下可拦截 74-90% 的危险误报。
Who Verifies the Agent's Success Claim? Self-Report Leakage in GUI-Agent Completion Judging
In automation pipelines, a GUI agent's confident success report can let downstream stages proceed even when the recorded execution trace does not show that the agent produced the requested outcome. We call this case a dangerous misreport: an unhedged success claim that the trace does not support as causal accomplishment during the run. We study report--trace auditing, which checks an agent's completion claim against an independently recorded trace. A controlled aware/blind intervention reveals self-report leakage: the agent's own self-report changes how completion is judged. The same judge reads the same task and trace; only that self-report is included or withheld. Withholding it improves trace-only dangerous-misreport recall by 43.4 percentage points with Qwen3.5-35B-A3B and 13.3 percentage points with DeepSeek-284B-A13B, with the same trend on held-out Batch 2. This motivates report isolation. The report records what the agent claims, but it must not influence the trace-state judgment. We implement this separation with a structured auditor that separates claim interpretation from claim-blind trace analysis and applies deterministic rules to extracted evidence. Because evidence extraction is separated from the policy that consumes it, the same audit record can be replayed under alternative policies without new model calls. The auditor achieves F1 0.75--0.78 on the 465-record audit-target set and 0.77--0.81 on held-out Batch 2, outperforming claim-aware and prompt-blind controls in recall and F1. Under audit-stage gating, where flag and review both block automatic pass, it blocks 74--90% of dangerous misreports at 45--56% inspection load, or 16--19% of the full in-scope stream after coarse status triage.
