AI 看屏幕没用，得看屏幕怎么变
现在的 AI 助手帮你点手机、操作网页时，安全监控只看「当前屏幕对不对」。但攻击者可以偷一个合法屏幕(比如登录页)在你点「查看订单」后弹出来，屏幕本身没错，错的是「不该出现在这里」。这篇论文让 AI 学会预测「点了这个按钮之后，下一屏应该长什么样」，再拿真实屏幕和预测比对，不一致就报警。它不用额外模型去读文字或图片，直接在 AI 内部表示空间里比，判断一次只要 17 毫秒，准确率接近最强商用模型，但快几千倍。它不是你明天就能装上的功能，但它指出了一个方向：AI 的安全感，不该来自「看对了什么」，而该来自「知道接下来会发生什么」。
📄 原文摘要(英文)
A login screen that appears after a tap on Sign in is expected; the same screen after a tap on View order is an attack. For GUI agents, safety is therefore a property of the transition rather than of the screen, and a monitor that inspects only screens can be defeated by reusing a legitimate one. Judging a transition requires an expectation of what should have followed the action. Existing GUI world models provide one, but they output it as text, code, or images, so checking it against the observed screen requires a second model to judge the two. We argue that a world model meant for verification should instead predict in the space in which observations are encoded, and present LGWM, a decoder-free, action-conditioned world model that predicts the representation of the next screen directly, trained without semantic annotation on 1.85M real GUI transitions. Verification reduces to a vector comparison, and the same signal reveals whether a mismatch is harmful. We evaluate on RSWT-BENCH, a diagnostic where each credential screen appears under both a legitimate and a hijacked transition, so detectors that see only the screen are at chance by construction. The training-free score reaches 0.987 AUC at 17 ms per decision, on par with the strongest closed-source VLMs and about ten AUC points above generative GUI world models at over three orders of magnitude lower latency. The residual direction reaches 0.953 AUC at separating harmful from benign violations, where prompted VLMs are near chance. Further analyses show that the prediction is a usable future state rather than an anomaly score. World models have mostly served as simulators or planners; our results point to a third role, verification, for which predicting in representation space is the natural design.