{"id":"3f383e68-efc5-4b8c-84e0-10c9cdbddb95","arxiv_id":"2608.05563","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"At 10% attacker support, bounded trajectory poisoning embeds attacker-chosen behaviors into evolved skills in 91.0% of SkillClaw trials and 61.5% of Trace2Skill trials.","lead":"This paper shows that an attacker can poison a self-evolving AI agent system by feeding it a small number of fake 'experience' records, causing the system to write malicious instructions into its permanent skill library. The result matters because it identifies a new security boundary: systems that automatically turn experience into instructions can be hijacked by the experience itself.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 91.0% SER headline is measured with SkillClaw's optional session-quality judge and publish-time verifier disabled; no experiment shows the attack survives the default configuration.","rationale":"The reader's weakest assumption identifies the most load-bearing gap: the headline 91.0% SER is produced under a non-default configuration, and the paper provides no experiment measuring whether SkillClaw's optional quality gates would block the attack. This is not an internal inconsistency—the paper is transparent about disabling the gates—but it is a direct threat to the external validity of the central claim as stated in the abstract. The gates could operate on quality or consistency grounds, not provenance, and the paper's own results show that the pipeline is highly sensitive to trajectory properties, so their effect cannot be dismissed without measurement. The rest of the evidence (transfer to Trace2Skill, recurrence ablations, sensitivity to n) makes the mechanism credible, and the paper's artifact-level scope is honestly drawn. Therefore the appropriate verdict remains CONDITIONAL: the claim needs the missing gate-enabled experiment or an explicit configuration-bound restatement. I agree with the reader rather than proposing a different primary concern; the missing-artifact release is secondary and does not by itself change the scientific assessment of the central claim.","tokens_in":11882,"tokens_out":6631,"duration_ms":73207,"concrete_test":"Re-run the full RQ1 matrix (n=30, k=3, six evolvers, four families, 25 trials per cell) with SkillClaw's session-quality judge and publish-time verifier enabled, first together and then individually, and report SER plus the number of trials rejected by each gate. If SER remains near 91.0%, the concern is resolved; if it drops materially, the paper must explicitly scope the claim to configurations with those gates disabled.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—that 10% attacker support reliably embeds target behavior in SkillClaw—rests on the RQ1 main matrix, which deliberately disables SkillClaw's optional session-quality judge and publish-time verifier (Empirical Evaluation, RQ1). The paper asserts these are 'configuration-dependent quality gates rather than source-trust checks,' but this is an assertion, not a measured result. If a default deployment enables either module, poisoned trajectories could be rejected at inclusion (breaking C1) or the generated poisoned skill could fail verification before publication (breaking C3). The attack's own ablations show that seemingly minor changes in trajectory representation swing SER from 0/25 to 25/25, so the effect of these gates is plausibly large. Because the abstract and conclusion state the 91.0% result without this configuration caveat, the headline generalization is not yet supported for a default SkillClaw deployment.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces PoisonedEvolution, a trajectory-poisoning attack on self-evolving skill (SES) systems that distill agent trajectories into persistent skills. The attack is modeled as a skill-visible black-box attacker who contributes a bounded number of transformed trajectories to a shared evidence pool. Success is decomposed into three necessary conditions: C1 Inclusion, C2 Evolution Attribution, and C3 Realization, with attribution identified as the distinctive bottleneck. The authors evaluate the attack on two pipelines: SkillClaw (six LLM evolvers, four security-effect families, n=30, k=3) and Trace2Skill (same budget), reporting 91.0% Skill Embedding Rate (SER) on SkillClaw and 61.5% on Trace2Skill. Ablations show that recurring support, causal framing, and domain-aligned encoding are key determinants, and a pilot provenance-diversity gate is explored as a defense. The paper claims artifact poisoning, not runtime compromise, and explicitly limits its scope to the evidence-to-artifact boundary.","tokens_in":12035,"tokens_out":3730,"duration_ms":38273,"significance":"The central claim is important: if a 10% attacker support reliably causes an SES pipeline to author a skill containing attacker-selected behavior, this identifies a new security boundary distinct from direct skill-file poisoning or RAG retrieval poisoning. The paper's main strengths are the coherent C1–C3 decomposition, the transparent reporting of embedded/completed trial counts, the cross-system transfer attempt, and the inclusion of condition ablations that support the attribution-bottleneck hypothesis. The pilot provenance-diversity gate is a useful concrete design implication. The principal weakness is that the headline result is obtained with two optional SkillClaw quality modules disabled, with no experiment showing how the attack behaves when they are enabled; this leaves the generalization of the 91.0% figure to a default deployment unsupported. The utility check also appears to use the same trajectory-collection split, which limits its validity. If these gaps are addressed, the paper would be a solid contribution to the security evaluation of agent skill pipelines.","major_comments":[{"comment":"The main SkillClaw evaluation disables SkillClaw's optional session-quality judge and publish-time verifier, and the paper states that these are 'configuration-dependent quality gates rather than source-trust checks' without providing any experiment with them enabled. Because the abstract and conclusion report the 91.0% SER without this caveat, the headline claim is not yet supported for a default SkillClaw deployment. If either module rejects poisoned trajectories at inclusion (breaking C1) or rejects the generated artifact before publication (breaking C3), the attack's success could drop substantially. Please run the main n=30, k=3 matrix, or at least a representative subset covering all six evolvers and four families, with both modules enabled, and report SER alongside C1 and C3 separately. The abstract's unconditional claim should be qualified until this experiment is provided.","section":"Empirical Evaluation, RQ1 (Table 1) and Background"},{"comment":"The benign-task utility check is performed 'on the 100-task trajectory-collection split' with Qwen3.5-122B-A10B, which appears to be the same 100 SpreadsheetBench training tasks used to create the source corpus described at the start of the evaluation section. If the utility evaluation uses the same tasks from which poisoned trajectories were constructed, the comparison between poisoned-evolved skill (20.0% Hard) and no-skill (18.0% Hard) is not a valid held-out utility measurement; it may simply reflect overfitting to the poison distribution. Please evaluate on a held-out set of tasks disjoint from the poisoning corpus, or explicitly state and justify that the 100-task split is separate from the poisoning construction. This matters because the paper presents the utility check as evidence that poisoning 'coexists with the normal-task benefit of skill use.'","section":"Empirical Evaluation, RQ1 (Benign-task utility check)"}],"minor_comments":[{"comment":"The no-init diagnostic is described as using 'four representative evolvers' but reports 490/600 trials. With 25 trials per model–family cell and four families, four evolvers would yield 400 trials, not 600. Please reconcile the denominator and specify which evolvers and how many trials per cell were used; the current text is arithmetically inconsistent.","section":"Empirical Evaluation, RQ1 (no-init diagnostic)"},{"comment":"The SER detection relies on 'family-specific, diff-aware canary rules' but the exact rules are not provided and no code is released. To make the 546/600 and 369/600 counts reproducible, please include the full rule set in an appendix or release the evaluation code.","section":"Metrics"},{"comment":"The conversion of GLM-5 execution logs into SkillClaw-compatible sessions is not described. Please specify the conversion procedure, including how task instructions, tool calls, and outcomes are mapped to session fields, since the attack's C1 feasibility depends on this representation.","section":"Empirical Evaluation, RQ1"},{"comment":"The C3-oriented comparison varies the behavioral encoding and the workflow locus simultaneously, and the text acknowledges this; the caption should state explicitly that this is a stress test rather than a single-variable causal ablation, to avoid readers misinterpreting the 0/25 result for the 'Auxiliary' variant.","section":"Figure 3"},{"comment":"The distinction between artifact poisoning and runtime impact is well taken, but the paper could define an explicit 'artifact-only' scope note in the metrics subsection so that future readers do not confuse SER with execution-based attack success rates.","section":"Discussion"}],"recommendation":"major_revision","confidential_remarks":"The core idea and evaluation design are sound, and the C1–C3 framework is a valuable lens for SES security. The main issue is that the headline quantitative claim is conditional on disabling optional quality gates, and the paper does not report the result with them enabled. This is a fixable gap, but it is load-bearing for the abstract's unqualified 91.0% statement. The utility-check split issue also needs clarification. I would not reject the paper, but a major revision is needed to either add the missing experiments or substantially qualify the headline claim. The paper's citation list includes many 2026 preprints; the authors should verify that these references are real and correctly cited before resubmission."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe short version: this is the first clean attack on the evidence-promotion step of self-evolving skill systems, and the core mechanism is plausible and well-ablated. Read it for the C1–C3 factorization and the ablation story, which are genuinely new. But treat the 91.0% headline as conditional: the main SkillClaw matrix disables two optional quality gates (session-quality judge and publish-time verifier) and nothing shows the attack survives with them enabled.\n\nWhat's new: prior work poisoned skill files directly or corrupted retrieval context. PoisonedEvolution targets the step where trajectories become promoted skills, which is a real and understudied boundary. The Inclusion–Attribution–Realization factorization is useful; attribution as the bottleneck (recurring, causally-framed, domain-aligned evidence) makes sense and the ablations back it. The k=1 vs k=2 jump (5/25 to 21/25) and the causal vs local insertion (25/25 vs 8/25) are clean, convincing demonstrations. Transfer to Trace2Skill at 61.5% is a nice generality check, and the family-level differences (F4 easy in SkillClaw, hard in Trace2Skill) show the authors understand their own mechanism.\n\nSoft spots, in order. First, the missing baseline with the optional gates enabled. The paper's assertion that these are 'configuration-dependent quality gates rather than source-trust checks' may be true, but it is not a measurement. Given their own C3 ablation swings from 25/25 to 0/25 on representation changes, the gates could plausibly matter. The abstract and conclusion state 91.0% without this caveat, which overstates the claim for a default deployment. Second, no code or data release; the canary rules for SER detection are author-defined, which is fine but needs to be shipped for others to audit. Third, the benign-utility check is a single-split sanity check, not a real utility-preservation argument; the authors are appropriately cautious there, so I would flag it as minor.\n\nThe circularity concern does not land: designing an attack to satisfy C1–C3 and then measuring those conditions is standard practice, and the budget k is a chosen operating point with a sensitivity curve, not a fitted value.\n\nWho benefits: security researchers working on agent supply chains and anyone building SES systems. It deserves serious peer review; the authors should be asked to run the gates-on baseline and release code. I would take it.","headline":"First clean attack on the evidence-promotion step of self-evolving skill systems, with strong ablations; the 91% headline is conditional on disabling optional quality gates, but the core mechanism holds up.","tokens_in":12569,"tokens_out":1997,"would_cite":true,"duration_ms":20926,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"An attacker who seeds 10% of the shared trajectory pool can get a self-evolving agent system to author a skill containing the attacker's chosen behavior.","keywords":["trajectory poisoning","self-evolving skill systems","LLM agent security","skill injection","evidence promotion","provenance-aware defense","canary evaluation","attribution bottleneck"],"falsifier":"Run the main SkillClaw evaluation at $n=30$, $k=3$ across the six evolvers and four behavior families with the session-quality judge and publish-time verifier enabled and see whether the skill embedding rate falls from 91.0% to near zero; a complementary test would spread the attacker's records across diverse contributor identities to see whether the pilot three-user provenance gate is actually evadable.","tokens_in":11702,"feed_emoji":"🎯","tokens_out":9025,"duration_ms":76046,"temperature":0.7,"pith_summary":"Self-evolving skill systems distill agent trajectories into persistent skills, letting shared experience become standing instruction. This paper shows that an attacker who contributes only a small share of ordinary-looking trajectories to the shared evidence pool can reliably get such a system to write the attacker's chosen behavior into a skill. The attack needs no direct edit of the skill bank, no compromise of the evolver, and no malicious skill upload; it works by making the behavior look like a recurring, causally useful pattern worth promoting. In the primary SkillClaw evaluation at a 10% attacker share, the target behavior appeared in the evolved skill in 546 of 600 trials (91.0% skill embedding rate), and in 369 of 600 trials on the structurally different Trace2Skill pipeline, so the mechanism transfers across evolution architectures. If correct, this makes evidence promotion a security boundary: the system itself becomes the author of the poisoned instruction.","feed_headline":"10% attacker evidence becomes a poisoned skill in 91% of trials","feed_subtitle":"At one in ten trajectories, six mainstream LLM evolvers wrote the attacker's target behavior into the published skill.","key_machinery":"The central object is PoisonedEvolution's trajectory transformation $\\tau' = \\mathcal{T}(\\tau; s, b)$, which keeps the original task and outcome while inserting the target behavior $b$ at a plausible workflow locus and tying it to the outcome with a causal bridge: a constraint or requirement followed by $b$ and then successful completion, or a failed trace whose failure appears explained by the absence of $b$. The success criterion $\\mathrm{PoisoningSuccess} = C_1 \\wedge C_2 \\wedge C_3$ makes the mechanism explicit, with $C_2$ Evolution Attribution carrying the load because the evolver must interpret the repeated pattern as reusable experience, not as a one-off accident or an unsafe detour. Recurrence is what makes the attribution work: a single poisoned record is weak, while two or three consistent records look exactly like the experience the pipeline is designed to distill.","core_discovery":"The paper's central claim is that trajectory-grounded self-evolving skill systems are vulnerable to artifact poisoning through evidence alone. The attacker, modeled as a skill-visible black-box contributor with bounded input-side control, transforms a few of its own trajectories so that the target behavior appears causally relevant to the recorded outcome, recurs across the poisoned subset, and is encoded in actionable, domain-aligned language. Poisoning success is defined as the conjunction of three necessary conditions: Inclusion (poisoned records pass the filter and enter the evolution stream), Evolution Attribution (the evolver credits the behavior as a reusable, skill-worthy pattern rather than noise), and Realization (the behavior survives summarization and merge into the generated skill). The paper identifies Evolution Attribution as the distinctive bottleneck that separates this attack from retrieval-time poisoning, and its main empirical result is a 91.0% skill embedding rate at 10% attacker support across six evolvers and four security-effect families in SkillClaw, with a 61.5% rate on Trace2Skill.","pith_inferences":["The attribution-bottleneck framing likely applies to any agent system that distills repeated, goal-linked observations into durable policy, such as memory consolidation or experience replay.","An adaptive attacker could plausibly evade the pilot three-user provenance gate by spreading poisoned records across multiple identities; testing this evasion is a natural next step the paper does not run.","Because the success ordering of the four behavior families reversed between SkillClaw and Trace2Skill, a detector tuned to one family or pipeline may miss the same effect when the behavior is framed differently.","A longitudinal evaluation of multi-cycle evolution is the key unmeasured consequence: a poisoned skill may generate trajectories that make the pattern look independently validated, turning a single injection into a stable backdoor."],"forward_implications":["A system that accepts trajectories from untrusted or Sybil contributors can be made to author a poisoned skill with only a 10% adversarial share of the evidence pool.","Raising attacker support from one to three consistent records in a 30-record batch lifts success from 5/25 to 25/25, so recurrence is the decisive input-side lever.","The attack transfers across different evolution architectures, so defenses that check only final skill text will miss the same poisoning effect in a differently routed pipeline.","Effective mitigation must happen at promotion time: provenance-aware checks that establish independent support before a pattern becomes shared instruction.","Because a poisoned skill guides future agents, repeated evolution cycles could convert one injection into self-confirming evidence, which the paper's single-cycle scope does not cover."],"supporting_citations":[{"why":"Supplies SkillClaw, the primary SES pipeline whose evolution cycles are attacked.","marker":"Ma et al. 2026"},{"why":"Supplies Trace2Skill, the structurally different pipeline used to show transfer.","marker":"Ni et al. 2026"},{"why":"Supplies the 300 SpreadsheetBench execution logs converted into the trajectory pool.","marker":"Ma et al. 2024"},{"why":"Supplies the four security-effect families (Skill-Inject) adapted here as inert canary payloads.","marker":"Schmotz et al. 2026"},{"why":"Defines the retrieval-time poisoning baseline the paper distinguishes artifact poisoning from.","marker":"Zou et al. 2025"}],"fun_headline_variants":["10% poisoned traces embed into 91% of evolved skills","Self-evolving agents hijacked by trajectory poisoning","Trajectory attack turns evidence into instruction","91% skill takeover with just 10% attacker traces","Poisoned paths become permanent skills in self-evolving agents"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The headline success rate assumes that the pipeline's optional quality gates — the session-quality judge and publish-time verifier, which the main evaluation leaves disabled — would not reject the poisoned trajectories if they were turned on.","fun_headline_variants_meta":{"raw":{"variants":["10% poisoned traces embed into 91% of evolved skills","Self-evolving agents hijacked by trajectory poisoning","Trajectory attack turns evidence into instruction","91% skill takeover with just 10% attacker traces","Poisoned paths become permanent skills in self-evolving agents"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000205,"raw_usage":{"total_tokens":1415,"prompt_tokens":988,"completion_tokens":427,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":604,"completion_tokens_details":{"reasoning_tokens":351}},"tokens_in":604,"tokens_out":427,"duration_ms":4743,"temperature":1.0,"reasoning_tokens":351,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T04:25:13.814840+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the main SkillClaw evaluation at $n=30$, $k=3$ across the six evolvers and four behavior families with the session-quality judge and publish-time verifier enabled and see whether the skill embedding rate falls from 91.0% to near zero; a complementary test would spread the attacker's records across diverse contributor identities to see whether the pilot three-user provenance gate is actually evadable.","supporting_citations":[],"review_version":2}