DECEPTICON: How Dark Patterns Manipulate Web Agents

TL;DR

Decepticon introduces a large, reproducible benchmark to quantify how dark patterns manipulate autonomous web agents. It reveals that dark patterns reliably steer agent behavior toward malicious ends, with effectiveness rising with model capability and reasoning depth, while current defenses offer only partial mitigation. The work provides extensive generated and in-the-wild task data, human baselines, and defense analyses, underscoring the urgent need for robust, cross-scale defenses against manipulative web designs. The open-source nature of the benchmark supports ongoing research in adversarial robustness for web agents and informs safer deployment of autonomous browsing systems.

Abstract

Deceptive UI designs, widely instantiated across the web and commonly known as dark patterns, manipulate users into performing actions misaligned with their goals. In this paper, we show that dark patterns are highly effective in steering agent trajectories, posing a significant risk to agent robustness. To quantify this risk, we introduce DECEPTICON, an environment for testing individual dark patterns in isolation. DECEPTICON includes 700 web navigation tasks with dark patterns -- 600 generated tasks and 100 real-world tasks, designed to measure instruction-following success and dark pattern effectiveness. Across state-of-the-art agents, we find dark patterns successfully steer agent trajectories towards malicious outcomes in over 70% of tested generated and real-world tasks -- compared to a human average of 31%. Moreover, we find that dark pattern effectiveness correlates positively with model size and test-time reasoning, making larger, more capable models more susceptible. Leading countermeasures against adversarial attacks, including in-context prompting and guardrail models, fail to consistently reduce the success rate of dark pattern interventions. Our findings reveal dark patterns as a latent and unmitigated risk to web agents, highlighting the urgent need for robust defenses against manipulative designs.

Figures (10)

• Figure 1: Examples of dark pattern-injected tasks in Decepticon. Decepticon is split into six categories of dark patterns by mode of attack, which result in privacy leaks, unwanted notifications or engagement, or unexpected expenditure. We show the lowest effectiveness across tested agents.
• Figure 2: Impact of model size and reasoning capability on dark pattern effectiveness; DP effectiveness increases with both factors. The results are evaluated on the Generated split of Decepticon.
• Figure 3: ICP and guardrail models versus baseline agent performance on Decepticon.
• Figure 4: Data collection pipeline overview.
• Figure 5: Example of a generated e-commerce website with dark pattern implementations. This is a Trick Question dark pattern.