{"id":"4d299168-9179-4947-ad38-1ebd745cbced","arxiv_id":"2608.09577","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":8,"one_line_summary":"A single poisoned agent skill can carry a weight-free conditional backdoor, with the rule in the skill file and the trigger in the query, so the payload fires only when both appear.","lead":"A new attack shows how a malicious skill installed by an AI agent can stay harmless in everyday use and only activate its hidden payload when a specific trigger phrase appears in a user request. If it works as reported, a single poisoned skill could quietly compromise many agents without retraining or weight access.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Near-zero FPR is an artifact of testing one hand-picked benign query per skill; the paper's own cross-task test shows FPR 12–16% on varied benign instructions, so the 'dormant on benign inputs' premise is unverified on real traffic.","rationale":"The reader's weakest_assumption is exactly the load-bearing point: near-zero FPR depends on gate words not appearing in benign requests, yet FPR is measured on one hand-picked query per skill. My independent reading of §5.1 and Fig. 4 confirms this is not merely a missing robustness check but an internal tension: the cross-task transferability experiment shows FPR rising to 12.4–15.8% on 20 varied LLM-generated instructions per skill. Those instructions are benign (trigger-free) and task-appropriate, so they are exactly the 'normal tasks' that the attack claims not to affect. The reason is structural: the gate words G are payload-unique but expressed in natural language (e.g., 'environment-sync validation'); the condition C will match any request that semantically contains those words, and nothing in Eq. 3 bounds the probability of such matches over a real query distribution. The attacker is gray-box and cannot observe victim traffic (§3.1), so the method has no online calibration that could adapt the gate to actual usage. Other issues (unspecified behavioral oracle, no artifact, trigger-injection channel unvalidated) are secondary; the FPR evidence gap alone is sufficient to block the headline 'near-zero FPR' and 'without affecting normal tasks'. I therefore agree with the reader's CONDITIONAL verdict: the attack idea is plausible and weight-free, but the paper must either supply a realistic FPR evaluation or temper the claims. A concrete fix would be to report FPR on a broad held-out corpus with confidence intervals, and to release code/skills for independent verification. Given the reader already reached CONDITIONAL, my stress-test does not change that verdict.","tokens_in":14431,"tokens_out":5692,"duration_ms":51961,"concrete_test":"Recompute the FPR (and CAC) columns of Table 1 using, per skill, a benign test set of the 20 varied task instructions already used in Figure 4 plus all original example queries (rather than one selected query), or a fresh held-out corpus of ≥100 natural in-domain requests per skill sampled from real usage logs or independently paraphrased. If the mean FPR over 50 skills exceeds 5% (or any behavior shows FPR >10%), the near-zero FPR claim is refuted. Also report the selection criterion for the original single benign query to rule out cherry-picking.","verdict_should_be":"UNCHANGED","load_bearing_attack":"ElasticBack's defining claim is that the payload fires 'only when both co-occur' and is 'dormant on benign inputs' (abstract, §1). The mechanism relies on gate words G mined from the payload vocabulary (Eq. 3, θ_g=0.60) and a rule condition C phrased with G as a feature flag (§4.2). The near-zero FPR is measured with exactly one benign query per skill, selected from the skill's own in-domain examples (§5.1, 'each skill receiving ... one benign query'), so the evaluation cannot show that G is absent from realistic user requests. The paper's own cross-task experiment (Fig. 4) evaluates each poisoned skill on 20 LLM-generated task instructions and reports FPR of 12.4–15.8% (vs 0–2% on the source query). That is direct evidence that the gate condition C is satisfied by trigger-free, task-appropriate benign instructions once the query distribution is broadened. Since the attacker cannot observe victim traffic at deployment (§3.1), nothing in the method guarantees the single-query FPR will transfer to real users. Thus the central 'conditional / without affecting normal tasks' claim rests on an unmeasured distributional assumption that the paper's own data contradict.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ElasticBack, a conditional single-skill backdoor attack against LLM-agent skills. The attacker inserts a gated rule R into Skill.md and a natural-language trigger T into the user query, with R and T coupled through payload-derived gate words G. The payload is supposed to fire only when both the trigger and the rule condition co-occur, while benign queries leave the skill dormant. The authors describe a semantic-anchored rule injection step and a stealth-constrained genetic search (C-HGA) for trigger evolution. They evaluate the method on three target behaviors with 50 skills each, four agent LLMs, three attack baselines, and three defenses, reporting high attack success rate (ASR), near-zero false-positive rate (FPR), preserved clean accuracy, cross-model transfer, and defense evasion. The paper also includes ablations and hyperparameter sensitivity studies.","tokens_in":14711,"tokens_out":4753,"duration_ms":46294,"significance":"If the central claims held, ElasticBack would be a notable contribution: it identifies a realistic supply-chain attack surface that is weight-free, single-skill, and conditional, and it provides a concrete mechanism (gate-word anchoring plus coupled trigger-rule optimization) that is more sophisticated than the always-on injection baselines. The cross-surrogate and cross-task experiments, together with the component ablations, are valuable steps toward understanding when such backdoors generalize. However, the paper's headline claims outrun the evidence: the 'near-zero FPR' rests on a single hand-picked benign query per skill, and the paper's own cross-task experiment reports FPR around 12-16% on broader benign instructions. The behavioral oracle that determines whether the payload fires is never described, and the statistical protocol provides no confidence intervals or repeated runs. These issues directly affect the main advertised properties (dormancy and precision), so the contribution is currently a promising attack design rather than a fully established one.","major_comments":[{"comment":"The central 'near-zero false-positive rate' claim is not supported by the evaluation protocol. In §5.1, each skill is tested with exactly one benign query, selected from the skill's own in-domain examples, so the reported FPR is an estimate over 50 hand-picked queries and cannot characterize how often the gate condition C in Eq. (4) is satisfied by real user traffic. This is directly contradicted by the paper's own Fig. 4b, where the same poisoned skills, when evaluated on 20 LLM-generated task instructions, show FPR of 12.4-15.8% on the GLM-5.2 victim, versus 0-2% on the source query. Since §3.1 states that the attacker cannot observe victim queries at deployment, a single-query FPR does not transfer to a distribution. The authors should report FPR over a broader and more realistic corpus of benign task instructions, with confidence intervals, and either reconcile the cross-task numbers with the abstract's 'without affecting normal tasks' or substantially weaken the claimed dormancy property.","section":"§5.1, Fig. 4"},{"comment":"The 'behavioral oracle' that decides whether the agent invoked the payload is never described. Eq. (5) evaluates each candidate trigger with a behavioral oracle that checks whether the agent invokes script s, and §5.1 states that ASR/FPR are measured by whether the payload fires, but the manuscript does not specify how this is determined: is it by reading tool-call logs, by checking file-system side effects, or by an LLM judge? The exact detection criterion is load-bearing for all reported ASR and FPR numbers, and without it the evaluation is not reproducible. The authors should define the oracle precisely and, if it is itself an LLM, discuss the risk of circularity or proxy error.","section":"§4.3, Eq. (5), §5.1"},{"comment":"The statistical reporting is inadequate for the strength of the claims. Every reported rate is based on one triggered query and one benign query per skill, with no confidence intervals, no repeated runs, and no variation of decoding settings. The statement 'as decoding is deterministic (temperature=0), per-query outcomes are fixed' is an unverified assumption: temperature-0 sampling in modern LLM APIs is not a formal guarantee of determinism, and even deterministic decoding can be sensitive to prompting order and batching. Differences of 2-4 percentage points between rows in Table 1 are therefore within the noise of the protocol. The authors should report repeated runs, confidence intervals or error bars, and ideally multiple benign queries per skill.","section":"§5.1"},{"comment":"The GLM-5.2 rows in Table 1 are in-sample results, because GLM-5.2 is the default surrogate used to optimize both the rule and the trigger. Those ASR/FPR values are outcomes of the optimization, not independent predictions. The cross-surrogate experiment in Fig. 3 provides some independent evidence, but it is limited to two victims and only reports ASR/FPR without the corresponding ∆CAC. To support 'transfers across models,' the authors should report out-of-sample performance for all four victims when the surrogate is GLM-5.2 and for at least one additional surrogate-victim pair, with confidence intervals.","section":"Table 1, Fig. 3"},{"comment":"The defense-evasion evaluation for Behavioral Monitoring is largely circular with the single-query FPR protocol. The monitor is described as running skills on benign queries and flagging any whose payload fires, so if FPR is measured on one hand-picked benign query per skill, an evasion rate of 98-100% is a direct consequence of the near-zero FPR measured on those same queries. The defense should be evaluated on a diverse set of benign instructions (e.g., the 20-task corpus from Fig. 4) to determine whether the backdoor actually stays dormant under realistic monitoring. Similarly, the LLM-as-Judge Audit setup is underspecified: which judge model, what system prompt, and how many audit attempts?","section":"§5.1, Table 3"}],"minor_comments":[{"comment":"The table caption says 'Attack stealthiness of ElasticBack (%)', but Cos-Sim and MMD are not percentages; please correct the caption or the units.","section":"Table 2"},{"comment":"The formula for F(T) has an unbalanced bracket: it reads 'F(T) = α [ASR(T) + λStealth(T) − Π(T)' without a closing bracket. Please fix the typo and ensure the operator precedence is clear.","section":"Eq. (5)"},{"comment":"The notation CACclean is used in the definition of ∆CAC but is never formally defined; please define it explicitly (presumably the benign solver rate on the clean skill before the rule is inserted).","section":"Eq. (1)"},{"comment":"The sentence 'FPR never exceeds one benign query' is confusing because FPR is a percentage, not a count; please rephrase to say that the FPR corresponds to at most one out of the 50 benign queries firing.","section":"§5.2"},{"comment":"The row label 'Imperative' for Rule R is ambiguous; it appears to denote an unconditional imperative form without the conditional structure. Please rename it (e.g., 'Unconditional imperative R') to avoid confusion with the conditional imperative used in ElasticBack.","section":"Table 4"},{"comment":"The dataset is described as curated from ClawHub, but the footnote 'https://clawhub.ai/skills' should be accompanied by a retrieval date and, if possible, a version or hash so that the experiments are reproducible.","section":"§5.1, Dataset"}],"recommendation":"major_revision","confidential_remarks":"The attack design is interesting and the paper is generally well written, but the evaluation systematically under-tests the two properties that define the contribution: dormancy on benign inputs and precision of the trigger. The single-query FPR protocol, the absence of an oracle description, and the lack of repeated runs make the headline numbers difficult to interpret. The paper's own cross-task experiment already suggests that the real FPR on varied benign instructions is an order of magnitude higher than the claimed 'near-zero' figure. I would encourage the editor to seek a revised version with distributional FPR measurements, a precise behavioral oracle, and confidence intervals; if those cannot be produced, the claims should be scaled back substantially."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nRead ElasticBack. The core idea is worth taking seriously: a conditional, weight-free, single-skill backdoor for LLM-agent skills, where payload-derived gate words bridge a rule in Skill.md and a trigger in the user query. That configuration is genuinely absent from the cited prior work—SkillJect and Skill-Inject are unconditional, BadSkill needs weights, SkillTrojan needs multiple skills. The trigger-as-switch construction and the frozen-R/evolved-T separation are clean, and the ablations show the components matter. Cross-model and cross-surrogate results suggest the mechanism transfers. That is real ground.\n\nBut the paper oversells its own headline. The claim \"near-zero FPR\" and \"dormant on benign inputs\" is measured with exactly one benign query per skill (Section 5.1). That is not a distribution. The paper's own cross-task experiment (Figure 4) evaluates each poisoned skill on 20 LLM-generated task instructions and reports FPR of 12.4–15.8%, up from 0–2% on the source query. Those are benign, trigger-free instructions. That directly contradicts the \"without affecting normal tasks\" claim for any realistic workload. The single-query FPR is an artifact of picking one in-domain example that happens not to contain the gate words.\n\nOther soft spots, in proportion. The evaluation has no repeated runs and no variance; temperature-0 determinism is asserted, not shown. The behavioral oracle that decides whether the payload fired is never defined, which hurts reproducibility. The GLM-5.2 rows in Table 1 are in-sample optimization outcomes because the surrogate is also the victim; the cross-model rows carry the independent weight. The attack assumes the trigger can be injected through skill-governed channels (example prompts, tool outputs), but the experiments do not validate that in a real harness. No code or data is shipped.\n\nNone of this kills the central idea. The mechanism is coherent, the citation pattern is honest, and the limitations are not hidden—the cross-task numbers are right there in Figure 4. The problem is that the conclusions are written with more confidence than the evaluation supports. These are fixable issues: repeated trials, confidence intervals, a defined oracle, artifact release, and a realistic benign-query set.\n\nThis deserves a serious referee. I would send it to review with the expectation of major revision, not desk reject. If the authors tighten the evaluation, this could be a solid contribution to agent-skill security.","headline":"Novel and plausible conditional single-skill backdoor, but the near-zero FPR claim is undercut by the paper's own cross-task experiment; deserves major revision, not rejection.","tokens_in":15282,"tokens_out":2922,"would_cite":true,"duration_ms":27188,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A single maliciously crafted agent-skill file can carry a conditional backdoor that stays dormant in normal use and fires only when an attacker-controlled trigger phrase appears in the user request.","keywords":["LLM agent skills","conditional backdoor","trigger-as-switch","skill supply chain","skill poisoning","genetic search","stealth optimization","deployment-time defenses"],"falsifier":"Re-run each poisoned skill against a large corpus of naturally occurring, benign user requests in the skill's domain, or against many diverse paraphrases of the skill's tasks instead of one hand-picked query per skill, and count how often the payload fires; if the false-positive rate rises materially above the reported near-zero level on realistic traffic, the trigger-as-switch gate is not switch-like in practice.","tokens_in":14199,"feed_emoji":"💤","tokens_out":6288,"duration_ms":52858,"temperature":0.7,"pith_summary":"The paper tries to establish that an attacker who can publish one agent skill can plant a conditional, weight-free backdoor that remains dormant on ordinary queries and executes a malicious payload only when a co-optimized trigger phrase and a gated rule in the instruction file co-occur. It matters because agent skills are adopted almost verbatim from open supply chains, so a single skill can reach many agents, and existing defenses inspect skills at rest or on benign queries. The paper claims ElasticBack is the first conditional single-skill attack to achieve this without fine-tuned weights or multiple skills, and reports high attack success at near-zero false-positive rate with preserved clean accuracy across four agent LLMs and three target behaviors. If right, the effective security question shifts from detecting malicious text in skill files to controlling what runtime channels can carry a trigger.","feed_headline":"One poisoned skill file can hide a dormant backdoor in AI agents","feed_subtitle":"It wakes only when an attacker-chosen trigger appears, escaping static review and benign-behavior checks.","key_machinery":"The load-bearing mechanism is the trigger-as-switch construction: a payload-derived gate-word set $G$ links a document-side conditional rule $R$ and a query-side trigger $T$ so that the trigger is the sole switch that turns the payload on. The rule is generated in a canonical conditional form, “When $C$, invoke $s$ to $Z$, then produce $\\delta$; otherwise proceed normally,” using literal-match condition verbs, at least one gate word, and a negative-scope clause that protects benign behavior, and it is inserted at a low-salience position chosen from an attention-guided saliency map. The trigger is evolved by C-HGA, a constrained genetic algorithm seeded with the gate words and expanded with benign shadow tokens, whose fitness combines estimated attack success with a stealth term made of semantic fit, rule–trigger similarity, and a dependency-attachment score, followed by deterministic syntactic repair and LCB selection.","core_discovery":"The central claim is that a backdoor can be encoded entirely in a skill artifact, a natural-language rule $R$ in Skill.md plus a benign-looking trigger $T$ delivered through channels the skill governs, with no weight modification and no retraining. The two sides are bound by a trigger-as-switch construction: a small set of payload-unique gate words $G$, mined as terms in the payload vocabulary semantically far from the skill's core with a similarity threshold $\theta_g = 0.60$, seeds the rule's activation condition and anchors trigger evolution. With the rule frozen after a behavioral probe, a stealth-constrained genetic search called C-HGA evolves the trigger against that rule, and a lower-confidence-bound selection picks the deployed trigger. Across three target behaviors, each run on 50 skills, and four agent LLMs, the paper reports an average attack success rate of 89%, a false-positive rate of 6%, a clean-accuracy drop of 3%, and defense evasion rates of 82–86% against perplexity screening, 74–78% against LLM-judge auditing on two behaviors, and 98–100% against behavioral monitoring.","pith_inferences":["Beyond the paper: because the rule is deliberately written to read like an ordinary capability, text-level review is unlikely to be the primary defense; execution-level isolation such as sandboxing and capability approval, plus provenance for skill artifacts, is the more direct mitigation.","Beyond the paper: the gate threshold $\\theta_g$ is the key control knob, and the evaluation that sweeps it shows a single-peaked attack success at $0.6$; a defender could map the attack's real operating envelope by sweeping this threshold against realistic benign traffic.","Beyond the paper: the same coupling could be repurposed defensively, scanning skill documents for payload-like gate words and then monitoring user-side text for their co-occurrence, which would turn the trigger-as-switch mechanism into a detection signature."],"forward_implications":["A single poisoned skill can persistently redirect every agent that installs it, with no access to model weights and no runtime cost after publication.","Static inspection of the skill text and behavioral monitoring on benign queries will not catch the backdoor, because the rule reads as an optional capability and never fires without the trigger.","The attack transfers across victim models from a different surrogate family, so defense cannot assume the attacker needs the same model as the victim.","Because the trigger travels through skill-governed channels such as example prompts and tool or retrieval outputs, securing those channels is part of the defense surface.","The paper's own cross-task test shows the gating is calibrated to the source task: on non-source task instructions, attack success falls to 76.6–83.2% while false positives rise to 12.4–15.8%, though activation still separates from misfire."],"supporting_citations":[{"why":"Supplies the SkillJect always-on skill-injection baseline that ElasticBack must beat on false-positive rate.","marker":"Jia et al. 2026a"},{"why":"Supplies the Skill-Inject baseline for supply-chain poisoning of coding-agent skills.","marker":"Qu et al. 2026"},{"why":"Supplies the BadSkill baseline that requires a fine-tuned model bundled in the skill.","marker":"Tie et al. 2026"},{"why":"Supplies the SkillTrojan baseline that shards an encrypted payload across multiple skills.","marker":"Feng et al. 2026"},{"why":"Supplies the instruction-backdoor baseline whose semantic trigger is ported onto skills for comparison.","marker":"Zhang et al. 2024"},{"why":"Supplies the AutoDAN genetic-search idea on which the C-HGA trigger evolution is built.","marker":"Liu et al. 2024b"},{"why":"Supplies the perplexity-screening defense used to test whether the rule and trigger evade static inspection.","marker":"Shu et al. 2023"},{"why":"Supplies the LLM-as-judge auditing defense used to test whether the rule survives independent review.","marker":"Zheng et al. 2023"},{"why":"Supplies the behavioral-monitoring defense that runs skills on benign queries to detect payload firing.","marker":"Luo et al. 2026"},{"why":"Supplies the SBERT embeddings used to mine gate words, score insertion positions, and measure rule–trigger similarity.","marker":"Reimers and Gurevych 2019"}],"fun_headline_variants":["Dormant skill backdoor wakes only when attacker's trigger appears","Poisoned AI skill hides backdoor that triggers on chosen words","ElasticBack: stealthy backdoor in skills needs no model retraining","Skill backdoor stays benign until query contains hidden trigger","Conditional backdoor in agent skills evades static review and audits"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The near-zero false-positive rate rests on the assumption that the distinctive words tied to the malicious payload never occur naturally in real benign user requests, so the hidden rule is never accidentally tripped.","fun_headline_variants_meta":{"raw":{"variants":["Dormant skill backdoor wakes only when attacker's trigger appears","Poisoned AI skill hides backdoor that triggers on chosen words","ElasticBack: stealthy backdoor in skills needs no model retraining","Skill backdoor stays benign until query contains hidden trigger","Conditional backdoor in agent skills evades static review and audits"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000242,"raw_usage":{"total_tokens":1552,"prompt_tokens":999,"completion_tokens":553,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":615,"completion_tokens_details":{"reasoning_tokens":463}},"tokens_in":615,"tokens_out":553,"duration_ms":5324,"temperature":1.0,"reasoning_tokens":463,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T14:45:02.372711+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run each poisoned skill against a large corpus of naturally occurring, benign user requests in the skill's domain, or against many diverse paraphrases of the skill's tasks instead of one hand-picked query per skill, and count how often the payload fires; if the false-positive rate rises materially above the reported near-zero level on realistic traffic, the trigger-as-switch gate is not switch-like in practice.","supporting_citations":[],"review_version":1}