Enterprise AI Security

DMAST formalizes agent-attacker interaction as a two-player zero-sum Markov game. Both agent and attacker are instantiated from the same VLM, enabling efficient co-evolution. The HTML injection mechanism allows attackers to generate structured DOM modifications, consistently altering both modalities. The training pipeline consists of: Stage 1: Imitation Learning for stable initialization; Stage 2: Oracle-Guided SFT to instill task-focused reasoning amid noise, without acknowledging attacks; and Stage 3: Adversarial RL (Self-Play) using GRPO to drive strategic co-evolution.

On held-out MiniWob++ and out-of-distribution VisualWebArena tasks, DMAST significantly mitigates adversarial risks while simultaneously doubling task completion efficiency. Attacker success rates are reduced from 41.2% to 21.4%, and agent task completion improves from 6.2% to 10.2%. Our method outperforms established training-based and prompt-based defenses, confirming genuine co-evolutionary progress and robust generalization. Visual attacks were found to be significantly more effective than text-only injections, highlighting a critical gap addressed by DMAST.

The findings from DMAST provide a practical foundation for building safer multimodal AI systems. By demonstrating how to harden web agents against coordinated cross-modal attacks, this research paves the way for more reliable and secure autonomous agent deployments. The emergent diversity in attack patterns during self-play confirms the efficacy of co-evolution in fostering robust defenses. Future work will explore extending DMAST to broader attack objectives beyond sensitive data leakage.