VeriCUA: Learning Proactive Verification for Reliable GUI Agent Rewards: what it means for business leaders

A small trained judge that decides what to inspect in a live interface, and when to stop, grades computer-use agents more reliably than prompted frontier models, and the better grades train better agents.

1. What the method is

VeriCUA is a trained reward model for computer-use agents: a verifier that decides whether an agent actually finished a task in a desktop, mobile or web interface. It has two parts. A small trainable Judge, a vision-language model of one to four billion parameters, reads the agent's action history and final screenshots, writes out the checks the task implies, marks each satisfied, violated or unresolved, and decides whether to rule or to ask for more evidence. A frozen Probe, an off-the-shelf GUI agent, then opens menus, files and settings in the live post-task environment to settle the unresolved checks and reports back. The advance is that the Judge's strategy, what to check and when to stop, is learned by reinforcement learning from one verification attempt per task outcome, rather than written into a prompt. The authors publish code on GitHub.

2. Why the method was developed

Training agents with reinforcement learning needs a reliable success signal for every rollout. Hand-written evaluators are precise but must be built per task. Model judges that only read screenshots miss decisive state such as the contents of a saved file or a setting buried in a dialog. Verifiers that act in the environment exist, but their behaviour comes from prompting, and the authors show that scale does not fix this: prompted judges from a 4B model up to GPT-5.4 all sit near 68 to 70 percent macro-average agreement with ground truth, and few-shot examples barely move that. Their explanation is that a check's value depends on where the evidence lives in that environment, which is only revealed by executing it. Learning from execution is hard because an agent's terminal state cannot be faithfully replicated, so a verifier gets one attempt per state and standard group-comparison methods do not apply.

3. Who should care

Our ML platform and applied research leads should read this if we fine-tune agents that operate software, because the reward source is the ceiling on what such training achieves. Our QA and evaluation function should note that the same component is a post-hoc checker for agent products we buy or build, independent of training. Procurement and vendor management can use the paper's agreement figures as a yardstick when a computer-use vendor claims automated evaluation. Finance and infrastructure should note the cost argument: a locally served 1B to 4B judge replaces frontier API calls for every rollout. Security and compliance need to know that the Probe acts inside a live environment after the task; it is instructed only to inspect, never to complete or repair, but it still clicks, and that must run in isolated sandboxes.

4. How the method works

Each round the Judge produces a verdict and a status-annotated check list. Success requires every check satisfied, failure requires one violated, and either ends verification; otherwise the unresolved checks go to the Probe, which continues from the current state and returns status updates with supporting screenshots, up to a fixed number of rounds. The Probe never sees the Judge's reasoning and the Judge never sees the full Probe trace. Training starts with supervised fine-tuning on Kimi-K2.6 verification traces kept only when their verdicts matched executable outcomes. Online reinforcement learning then runs one verification per real agent terminal state and scores it with a schedule that pays most for a correct verdict without probing, less for a correct one after probing, penalises wrong unprobed verdicts hardest and unresolved outputs worst. REINFORCE++ normalises returns across the batch of unrelated states, so no environment forking is needed. The trained Judge is then frozen and its verdict becomes a binary reward for ordinary GRPO training of the acting agent.

5. How it was evaluated

Agreement is measured against executable task evaluators on OSWorld desktop tasks, the GUI-only part of MobileWorld, and WebArena-Verified Hard, using trajectories from five different actors spanning successes and varied failures. Only trajectories whose outcome is stable across six re-executions are kept, each proactive verifier trial runs in its own fresh re-execution, and results average four runs. Baselines are passive screenshot judges (DistRL, DigiRL, ZeroGUI), the prompted proactive verifier VAGEN, and the identical Judge-Probe loop driven by prompted models: the same 4B, 2B and 1B backbones, plus Kimi-K2.6 and GPT-5.4 with and without few-shot examples. Cost is counted as frozen-Probe tokens per judgment. The Judge is trained only on OSWorld, so mobile and web are zero-shot transfer. For downstream effect, one Qwen3-VL-4B actor is trained with GRPO under identical settings, varying only the reward source, and scored by Pass@4 on in-distribution single-application tasks and held-out multi-application tasks. Our copy of the paper lost the trajectory counts and token-reduction figures in rendering.

6. How it performed

The trained 4B Judge reaches 74.08 percent macro-average agreement against 68.72 for few-shot GPT-5.4 and 69.62 for Kimi-K2.6, leading on all three benchmarks (82.00 desktop, 77.50 mobile, 62.75 web). The 1B version reaches 71.62, above every prompted judge, and training lifts the 1B backbone by 21 points over its prompted self. The authors state fewer Probe tokens than GPT-5.4, though the exact figures did not render for us. As a reward, it raises actor Pass@4 from 43.93 to 47.14 overall and from 17.57 to 22.97 on held-out multi-application tasks, against 45.36 with ZeroGUI. During actor training it agrees with ground truth 81.4 percent of the time versus 77.8 for the prompted loop, with false negatives at 4.6 versus 10.0 percent. The limits are real: roughly one web verdict in three is still wrong, the web gain over the prompted 4B is only 1.25 points, downstream results cover one actor, and the Probe acts in live systems. Our call is to pilot it as the reward and audit layer for any agent training we run in sandboxed environments. (Source: arXiv 2610.26469, 2026)