DualTAP: A Dual-Task Adversarial Protector for Mobile MLLM Agents

Abstract

The reliance of mobile GUI agents on Multimodal LargeLanguage Models (MLLMs) introduces a severe privacy vulnerability:screenshots containing Personally Identifiable Information (PII) are of-ten sent to untrusted, third-party routers. These routers can exploit theirown MLLMs to mine this data, violating user privacy. Existing privacyperturbations fail the critical dual challenge of this scenario: protect-ing PII from the router’s MLLM while simultaneously preserving taskutility for the agent’s MLLM. To address this gap, we propose the Dual-Task Adversarial Protector (DualTAP), a novel framework that,for the first time, explicitly decouples these conflicting objectives. Dual-TAP trains a lightweight generator using two key innovations: (i) a con-trastive attention module that precisely identifies and targets only thePII-sensitive regions, and (ii) a dual-task adversarial objective that si-multaneously minimizes a task-preservation loss (to maintain agent util-ity) and a privacy-interference loss (to suppress PII leakage). To facilitatethis study, we introduce PrivScreen, a new dataset of annotated mobilescreenshots designed specifically for this dual-task evaluation. Compre-hensive experiments on six diverse MLLMs (e.g., GPT-5) demonstrateDualTAP’s state-of-the-art protection. It reduces the average privacyleakage rate to 31.7 percentage points (a 2.6× relative improvement)while, critically, maintaining an 80.8% task success rate—a negligibledrop from the 83.6% unprotected baseline. DualTAP presents the firstviable solution to the privacy-utility trade-off in mobile MLLM agents.Our code is available at https://github.com/fyzhang1/DualTAP.