ActReal paper: system-level mobile agents challenge automation detection

What happened on 2026-08-30

On 2026-08-30 at 20:55 UTC, Mingshuo Wang, Hanqing Guo and co-authors submitted v1 of 'ActReal: System-Level Mobile Agents Challenge Mobile Automation Detection' to arXiv. The abstract says system-level mobile agents are moving from fixed scripts to adaptive systems that observe interfaces, reason and adjust their actions, while existing app defenses detect automation through touch trajectories, action timing and the physical coupling between touch and IMU signals. The authors argue that a privileged system-level agent executor can control both touchscreen input and the sensor data delivered to apps, letting it generate time-aligned touch and six-axis IMU signals. The abstract reports a mean event-level attack success rate of 77.5%, and 71.1% even when detectors jointly observe touch and IMU signals.

What it means for protecting app logic

The paper touches a fundamental boundary: every behavioral signal an app reads on the client comes from an environment the attacker may control. Once an adversary has system-level privileges, touch trajectories, timing and sensor data can be generated rather than captured. Treating these signals as proof of a human is therefore unreliable; at most they are one input to a risk score. Device and app integrity attestation can answer whether the device and package are trustworthy, not whether the operator is a person. The limits: the paper assumes a privileged system-level executor, unprivileged scripts are outside that scope, and results will vary by detection scheme.

Checks you can run

Inventory features in your own app that decide 'is this automated' using only client-side touch or sensor signals, such as reward claims, voting, limited drops or anti-abuse checks. Add server-side business rules to those features: rate limits, per-account and per-device quotas, and monitoring for anomalous patterns. Use client behavior signals as one part of a risk score, never as a standalone pass condition. Do not claim publicly that your app can reliably tell people from automation agents. Include system-level agents in the threat model when evaluating solutions. Re-run this review whenever you add a new reward or quota feature.

Your checklist

• Inventory features that rely only on client behavior signals
• Add server-side rate limits and quotas to those features
• Use client signals as risk-score inputs, not pass conditions