In controlled benchmark tests, a runtime defense called Veer recorded a 0.3% deceptive-outcome rate on WebDecept and 4.5% on TrickyArena's single-pattern cases, while completing tasks without a recorded deceptive outcome in 41.0% and 85.2% of configurations, respectively. The findings come from an arXiv preprint.
The core question was whether Veer could prevent dark-pattern, or deceptive, outcomes without sacrificing successful task completion. The study uses three related measures: Dark Pattern Success Rate, or DPSR, is the share of evaluated configurations with at least one deceptive outcome; Task Success Rate, or TSR, is the share with successful completion; and Safe Task Completion, or STC, counts only configurations that do both.
How Veer intervenes
Veer assesses proposed actions against task authorization and the current Web state, then constructs a prospective intervention trajectory for unauthorized consequences. It grounds and verifies each transition on the live interface before returning control to the base agent.
The evaluation used two benchmark families. TrickyArena comprised 156 task-dark-pattern configurations, including 88 single-pattern and 68 multi-pattern cases. WebDecept comprised 45 shopping tasks, each evaluated under seven deceptive scenarios, yielding 315 task-scenario configurations. The comparison included No-Defense, ICP, Guardrail, DUDE-S2, Spotlighting, VIGIL and SafePred. Within each benchmark, the methods used the same task configurations, base agent, actor model and base task-step allowance.
What the benchmark numbers show
On TrickyArena-Single, Veer matched the highest task-success rate at 86.4%. Its deceptive-outcome rate was 4.5%, and its Safe Task Completion rate was 85.2%, 15.9 percentage points above the next-highest result. These figures came from the 88 single-pattern configurations.
On the 68 multi-pattern cases, Veer recorded 14.7% DPSR, 72.1% TSR and 67.6% STC. No-Defense recorded 54.4% DPSR and 66.2% TSR, while Veer's STC was 25.0 percentage points above the next-highest method.
On the full WebDecept evaluation, Veer had one dark-pattern success across 315 configurations, giving it a 0.3% DPSR and 41.0% STC. SafePred recorded 58.1% TSR, 38.1% DPSR and 38.7% STC. The combined STC measure is important here because it requires both successful completion and no recorded deceptive outcome.
On the ground-truth-feasible WebDecept subset, Veer recorded 0.0% DPSR and 57.3% for both TSR and STC. Its TSR was 7.1 percentage points above No-Defense. SafePred posted 64.4% TSR, 19.6% DPSR and 54.2% STC.
The pattern across conditions
The safety pattern was not confined to a single average. Across 22 TrickyArena-Single categories, Veer had the lowest or tied-lowest DPSR in 21 and avoided dark-pattern outcomes entirely in 20. On WebDecept, its mean per-scenario DPSR was 0.3%, while the worst-case DPSR was 2.2%.
Across 12 agent-model-benchmark comparisons, Veer had higher STC than matched No-Defense in every case. The gains ranged from 4.8 to 29.4 percentage points, and DPSR decreased by at least 20.5 points in all 12 comparisons.
What changed when the design changed
In the ablation comparisons, the w/o State Intervention variant recorded 51.1% TSR and 50.0% STC, compared with 86.4% TSR and 85.2% STC for Full Veer. Episodes with neither task completion nor a dark-pattern outcome were 38.6% in the variant, versus 10.2% with Full Veer.
The other ablation comparisons showed different scores. Reactive Intervention recorded 85.2% TSR, 6.8% DPSR and 80.7% STC, compared with 86.4%, 4.5% and 85.2% for Full Veer. The variant without temporal evidence recorded 80.7% TSR and 77.3% STC, versus 86.4% and 85.2% for Full Veer.
Where the evidence stops
The evidence has a clear boundary: it is limited to the evaluated benchmark settings. Additional Web environments and interaction settings are identified as future work, so the reported rates do not settle how the method would perform beyond those tests.
The manuscript is an arXiv preprint.
Paper data and sources
Original title: Before Acting, Change the State: Prospective State Intervention for Web Agents under Deceptive Interfaces
Authors: Ruozhao Yang, Mingfei Cheng, Xiaofei Xie
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-09-28
DOI: Not available
Original paper · Full text