{"id":"021d5919-e7cd-4865-9cbb-30fab7ef6618","arxiv_id":"2608.03509","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"Poisoned experience records can be compiled into agent skills that evade safety detection, route to future tasks, and persist after their source records are deleted.","lead":"This paper shows that a poisoned interaction record fed to a self-evolving agent can be automatically turned by the agent into a reusable skill that hides from safety checks and keeps working after the original record is deleted. It is a security report on a new attack surface for LLM agents, with experiments on two systems.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central 'durable behavioral artifact' claim rests on LLM-judge proxy labels rather than executed behavior; a sandboxed end-to-end run is needed to confirm the skills actually cause policy violations.","rationale":"After reading the full text, the single most load-bearing condition for the paper's central claim is not model representativeness but proxy faithfulness. The paper is admirably explicit in Sections 4.1 and 5.4 that trigger rates are routing-level surrogates; however, the abstract's 'attack success rates' and 'durable behavioral artifacts' are stated without that caveat. The three headline phenomena (whitewashing, promotion, persistence) are all measured by the same DeepSeek-v4-flash LLM judge plus regexes, and Section 4.8 shows this judge is strongly influenced by surface metadata rather than code content. Without an end-to-end execution check, the numbers could reflect the judge's classification behavior instead of real policy violations. I also considered two other concerns: the unit mismatch in Table 2 (per-trajectory raw detection versus per-skill derived detection), which could overstate whitewashing, and the A2S downstream result using a custom lexical retriever after excluding the native SDK mode, which weakens cross-system generality. These are real but secondary: they affect the magnitude or breadth of individual findings, whereas the proxy gap would invalidate the central behavioral claim itself. The paper's internal disclosures already support a CONDITIONAL verdict, so I recommend keeping that verdict while sharpening the condition to require sandboxed end-to-end execution on at least the SkillX routing evaluation.","tokens_in":14010,"tokens_out":11022,"duration_ms":109620,"concrete_test":"Run the SkillX 32-task routing evaluation end-to-end in a sandboxed AppWorld instance: let the agent actually execute the code generated by the routed skills against instrumented stub APIs, and record whether the target policy-violating action (for example, email to external address or unauthorized Venmo payment) occurs. Compare this execution-level success rate with the proxy trigger rate of 56.2%; also rerun the 25-task post-deletion condition with execution-level measurement to check whether the 80% persistence holds. If execution-level rates are materially below the proxy rates, reword the headline ASR and persistence numbers as routing-level only.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's three headline quantities—whitewashing (98.5% to 11.4%), downstream triggering (56.2% and 89.2%), and persistence (80.0%)—are all computed with the same policy-violation proxy: regexes plus a DeepSeek-v4-flash LLM judge. Section 4.1 explicitly labels these 'routing-level surrogates, not live-compromise rates,' and Section 4.8 shows the judge's verdicts are heavily driven by skill names and documentation rather than code content. The only behavior-adjacent evidence is Section 4.10's code-generation pattern match on 4 poisoned and 2 clean tasks, which is not execution. Consequently, the abstract's 'attack success rates' and 'durable behavioral artifacts' are not established: a routed skill that the proxy labels as violating could fail in real execution (bad API calls, agent adaptation, sandbox blocks), while a skill the proxy labels benign could still execute harm. The central claim would be false if the proxy's classifications do not track actual policy-violating actions.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces SkillJack, an attack that exploits the experience-to-skill pipelines of self-evolving agents. The attacker injects a poisoned trajectory; the agent's own pipeline compiles it into a reusable skill that is less detectable, routable to future tasks, and persistent after the source record is deleted. The authors evaluate on two systems, SkillX and Anything2Skill, using a shared dataset of 150 trajectories, and report three properties: sanitization whitewashing (LLM-judge detection drops from 98.5% on raw trajectories to 11.4% on extracted skills), cross-layer promotion (routing-level trigger rates of 56.2% and 89.2% on the two systems), and persistence isolation (80.0% of skill-based triggers survive source deletion). All effectiveness metrics are computed with a policy-violation proxy consisting of regexes and a DeepSeek-v4-flash LLM judge; the paper explicitly labels these as routing-level surrogates, not live-compromise rates.","tokens_in":14048,"tokens_out":5700,"duration_ms":55513,"significance":"If the empirical claims hold, SkillJack identifies a genuinely new attack surface: the transition from experience to skill in self-evolving agents, with implications for provenance-aware skill lifecycle defenses. The paper has notable strengths: a paired experimental design that separates framing from overt wording, a metadata ablation showing judge sensitivity to surface descriptions, evaluation on two independently implemented systems, transparent discussion of the proxy-based methodology, and public code. However, the central claim of 'durable behavioral artifacts' is supported only by proxy labels, not by executed behavior, and the single-model design weakens the cross-system generality claim. These are load-bearing concerns that require either additional execution-level evidence or a tempering of the paper's stated conclusions.","major_comments":[{"comment":"The headline numbers (98.5% to 11.4%, 56.2%, 89.2%, 80.0%) are all computed with the policy-violation proxy described in §4.1 (regexes plus DeepSeek-v4-flash LLM judge). The abstract states these as 'attack success rates' and 'durable behavioral artifacts,' but the paper itself notes they are 'routing-level surrogates, not live-compromise rates.' Because the judge is shown in §4.8 to key heavily on metadata, the proxy could both over- and under-approximate real policy violations. Please add a sandboxed execution study on a representative subset (e.g., the four case-study categories in Appendix C) in which the derived skills are actually run and their side effects are measured, and report the agreement between proxy classifications and executed outcomes. If live execution is not feasible, revise the abstract and conclusion to state plainly that the results are proxy-based and demonstrate a potential for durable artifacts, not demonstrated behavioral compromise.","section":"§4.1, Table 3, Abstract"},{"comment":"The cross-system generality claim is weakened by the use of a single model, DeepSeek-v4-flash, for all extraction, routing, judgment, and agent reasoning in both SkillX and Anything2Skill. The two systems are therefore not independent validations of the paradigm; a different model could behave differently in the extractor or the judge, changing the whitewashing, triggering, and persistence rates. Please evaluate at least one additional model (e.g., a different commercial API or an open-weight model) for the extraction-stage whitewashing and downstream routing experiments, or explicitly restrict the generality claim to the tested configuration.","section":"§4.1, §4.4, §5.1"},{"comment":"Several sample sizes are small, and the paper does not report confidence intervals or statistical tests for the headline rates. In §4.5, the persistence rate of 80.0% is based on 10 skill-based triggers (8 of 10); in §4.6, the clean-task trigger rate of 20.0% is based on 15 tasks, and per-category rates such as unauthorized transfer at 28.6% have wide intervals. Since these rates are central to the cross-layer promotion and persistence claims, provide confidence intervals or exact binomial tests for the main rates, and report the number of tasks per category in Figure 4.","section":"§4.5, §4.6, Figures 3 and 4"}],"minor_comments":[{"comment":"The phrase 'the model is an implementation detail, and our conclusions have not yet been replicated across models' reads as an assertion rather than a limitation; please rephrase to acknowledge that the single-model design is a current boundary of the empirical evidence.","section":"§4.1"},{"comment":"Clarify the relationship between the 505 extracted skills and the 356-skill routing library; the current text says the former refers to the two SkillX poisoned extraction sets, but it is easy to misread as a single shared library.","section":"§4.1, Table 5"},{"comment":"The y-axis label is 'Trigger rate (%)' but the figure also plots persistence and post-deletion rates; consider a more descriptive caption or a secondary axis label to avoid confusion.","section":"Figure 3"},{"comment":"Clarify why the metadata ablation uses 30 skills for the LLM judge and 50 skills for pattern matching; the differing sample sizes are not explained.","section":"§4.8"},{"comment":"The runtime monitor signature list is a hand-crafted free parameter, and the defense results are conditional on it; the paper already states this for the expanded set, but it should also be stated for the original 16-signature list.","section":"Appendix A.4"},{"comment":"Standardize the spelling of 'Anything2Skill' (the text alternates between 'Anything2Skill' and 'A2S'); also check for minor typos such as 'we release this as a technical report' in §5.4, which seems to state the obvious.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The paper is honest about its proxy-based methodology and the single-model design, but the abstract and conclusion overstate the evidence as demonstrating 'durable behavioral artifacts.' The authors should be encouraged either to provide a sandboxed execution study or to explicitly frame the results as demonstrating a potential for such artifacts. The cross-system claim would be substantially strengthened by using a second model for extraction and judgment."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The thing to know about this paper: it identifies a real and under-appreciated attack surface—the experience-to-skill compilation step—but its headline numbers are all proxy measurements from a single model, so read them as existence proofs, not deployment rates.\n\nWhat's new and good. Prior memory-poisoning work attacks the record at retrieval time. SkillJack attacks the transformation itself, so a poisoned trajectory becomes a durable skill that can outlive its source. That lifecycle gap is genuinely important, and the paper articulates it cleanly. The cross-system design is a real strength: two independently built pipelines, SkillX and Anything2Skill, both show the same laundering pattern, with LLM-judge detection dropping from ~98-100% on raw trajectories to 11-44% on extracted skills. The paired framing-vs-direct ablation and the metadata ablation are well done and show why: the judge keys on names and descriptions. The persistence experiment, though small, makes the provenance point vividly. The authors are also transparent about the proxy; they label everything as routing-level and release code.\n\nThe soft spots. The load-bearing measurement is the same policy-violation proxy everywhere: regexes plus a DeepSeek-v4-flash judge, with no live execution. As the stress-test note says, a skill that passes the proxy might not actually perform the harmful action, and one that fails it might still be benign in a real environment. Section 4.8 shows the judge is heavily surface-metadata-driven, which makes that worry concrete. The single-model setup compounds it: extractor, router, judge, and agent are all the same API model. Sample sizes are small—the persistence result is 25 tasks, the defense study is 15 or 20—and there are no confidence intervals. The A2S downstream result uses a lexical retriever after excluding the native SDK mode, so the 'two systems' claim is weaker for the routing part.\n\nMy take: the structural argument holds up. SkillJack deserves serious referee time, but the authors should be pushed to add at least one more model, report uncertainty, and run a sandboxed end-to-end check that actually executes the skills against a mock environment. Until then, the abstract's 'attack success rates' overstate what is demonstrated.","headline":"SkillJack identifies a real and under-appreciated attack surface—the experience-to-skill compilation step—but its headline numbers are all proxy measurements from a single model, so read them as existence proofs, not deployment rates.","tokens_in":14717,"tokens_out":3702,"would_cite":true,"duration_ms":35720,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SkillJack shows that a self-evolving agent's own experience-to-skill pipeline can convert poisoned experience records into durable, routable skills that evade detection and survive source deletion.","keywords":["skill backdoors","self-evolving agents","experience-to-skill pipeline","memory poisoning","skill extraction","sanitization whitewashing","persistence isolation","LLM agent security"],"falsifier":"Run the exact same 150-trajectory dataset and attack through a different extraction model and a different LLM judge: if the detection drop from raw trajectories to extracted skills substantially narrows, or if the routed skills no longer trigger the policy-violation proxy, then SkillJack's quantified claims would not generalize beyond the single evaluated model configuration.","tokens_in":13676,"feed_emoji":"🕳️","tokens_out":2379,"duration_ms":24542,"temperature":0.7,"pith_summary":"This paper tries to establish that a new class of attack exists: instead of poisoning the memory or context an agent reads, an attacker can poison the experience records an agent learns from, and the agent's own skill-extraction machinery will compile those records into persistent, reusable skills. The authors call this attack SkillJack and argue it has three properties: extraction hides the malicious intent (sanitization whitewashing), a transient experience becomes a permanent capability (cross-layer promotion), and deleting the original poisoned record does not remove the derived skill (persistence isolation). If true, it means self-improving agents that turn interaction logs into skills are vulnerable at a deeper layer than previously thought, and that cleaning up memory is no longer enough to remove an implanted behavior.","feed_headline":"Poisoned agent memories become undetectable, persistent skills","feed_subtitle":"Attack turns experience-to-skill pipelines into a laundering channel: 98.5% detection drops to 11.4%.","key_machinery":"The central object is the experience-to-skill pipeline, formalized as a four-stage load-transform-persist-route process that maps an experience record to a structured skill with a name, description, and code. The key mechanism is the transformation-resilient payload, a poisoned trajectory written with legitimate-looking functional framing so that extraction preserves the policy-relevant action while emitting benign-looking metadata. This framing is what produces sanitization whitewashing, because the LLM-driven transformation strips overtly malicious wording and normalizes the action into a plausible procedure.","core_discovery":"The paper's central claim is that poisoned experiences can be transformed by the agent itself into durable behavioral artifacts. In the evaluated SkillX pipeline, an LLM judge flags 98.5% of raw poisoned trajectories but only 11.4% of the skills extracted from them; in the Anything2Skill system detection falls from 100.0% to 44.4% in document mode. The extracted skills remain effective, triggering the policy-violation proxy for 56.2% of attack-oriented tasks on SkillX and 89.2% on Anything2Skill, and 80.0% of skill-mediated triggers persist after the source trajectories are deleted. The authors propose transformation-resilient payloads, trajectories framed as legitimate operations such as 'backup' or 'archive', as the mechanism that lets malicious actions survive extraction while appearing benign.","pith_inferences":["A natural extension the paper does not fully test is whether the whitewashing effect shrinks or disappears when a stronger or differently-aligned extractor or judge is used, since all measurements rely on a single LLM configuration.","If SkillJack transfers to other experience-learning mechanisms, such as reflection-based memory or tool synthesis, then any persistent artifact derived from untrusted experience could carry a similar hidden risk, not just explicit skills.","The clean-task collateral triggering observed in the paper implies that a defender cannot rely on an implanted skill firing only in its intended context, which could either aid detection or widen the blast radius depending on the attacker's goal.","A concrete testable extension would be to run the same 150-trajectory dataset through several different models and extraction pipelines to see whether the 98.5%-to-11.4% drop in detection is a robust phenomenon or an artifact of one model's judgment."],"forward_implications":["If the central claim is correct, clearing a poisoned memory or experience store no longer removes the attack, because the derived skill persists in a separately stored library.","Safety checks calibrated on raw trajectories or memories cannot be assumed to transfer to extracted skills; detection must be repeated at every artifact boundary.","Skill libraries become a new attack surface that is routable, meaning future queries can select the implanted skill without ever re-reading the original poisoned record.","Defenses that stack static review and runtime monitoring may interfere rather than compose, so layered defenses need to be designed jointly.","The attack generalizes across at least two independently implemented experience-to-skill systems, suggesting the risk is a property of the paradigm rather than of one implementation."],"supporting_citations":[{"why":"Provides the SkillX system, the primary evaluated implementation of experience-to-skill extraction and routing.","marker":"[14]"},{"why":"Provides the Anything2Skill system, the second independently implemented pipeline used to show cross-system generality.","marker":"[10]"},{"why":"Supplies the AppWorld application/API schema and trajectory format that the shared dataset is built on.","marker":"[13]"},{"why":"Establishes the prior memory-poisoning attack surface against long-term memory and retrieval stores that SkillJack extends to the skill layer.","marker":"[1]"},{"why":"Shows persistent compromise through poisoned experience retrieval, providing the direct-context baseline that SkillJack compares against.","marker":"[12]"},{"why":"Demonstrates poisoning of self-evolving agents via non-transferable experiences, a closely related prior mechanism.","marker":"[15]"},{"why":"Supplies the provenance and laundering argument that motivates the paper's proposed defense of tracking derived skills back to their sources.","marker":"[6]"}],"fun_headline_variants":["SkillJack: poison skills, not just memory, for stealth","Detection drops from 98.5% to 11.4% via skill extraction","80% of skill backdoors persist after source deletion","Self-evolving agents convert poisoned data into durable skills"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The weakest load-bearing premise is that the single LLM configuration used for extraction, routing, and judgment — DeepSeek-v4-flash — is representative enough that the measured whitewashing, triggering, and persistence numbers describe the paradigm rather than one model's behavior.","fun_headline_variants_meta":{"raw":{"variants":["SkillJack: poison skills, not just memory, for stealth","Detection drops from 98.5% to 11.4% via skill extraction","80% of skill backdoors persist after source deletion","Self-evolving agents convert poisoned data into durable skills"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000281,"raw_usage":{"total_tokens":1711,"prompt_tokens":1039,"completion_tokens":672,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":655,"completion_tokens_details":{"reasoning_tokens":601}},"tokens_in":655,"tokens_out":672,"duration_ms":7049,"temperature":1.0,"reasoning_tokens":601,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T04:26:05.859189+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the exact same 150-trajectory dataset and attack through a different extraction model and a different LLM judge: if the detection drop from raw trajectories to extracted skills substantially narrows, or if the routed skills no longer trigger the policy-violation proxy, then SkillJack's quantified claims would not generalize beyond the single evaluated model configuration.","supporting_citations":[{"cited_title":"Anything2Skill: Compiling External Knowledge into Reusable Skills for Agents","cited_arxiv_id":"2606.09316","evidence_quote":"Provides the Anything2Skill system, the second independently implemented pipeline used to show cross-system generality."},{"cited_title":"Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees","cited_arxiv_id":"2606.24322","evidence_quote":"Supplies the provenance and laundering argument that motivates the paper's proposed defense of tracking derived skills back to their sources."}],"review_version":2}