Pith. sign in

REVIEW 3 major objections 6 minor 22 references

SkillJack: Persistent Skill Backdoors in Self-Evolving Agents

T0 review · 3 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SkillJack shows that a self-evolving agent's own experience-to-skill pipeline can convert poisoned experience records into durable, routable skills that evade detection and survive source deletion.

desk verdict SkillJack identifies a real and under-appreciated attack surface—the experience-to-skill compilation step—but its headline numbers are all proxy measurements from a single model, so read them as existence proofs, not deployment rates. read the letter →

arxiv 2608.03509 v2 pith:UB5NTZGK submitted 2026-08-04 cs.CR

Zonghao Ying , Xiangfan Wu , Huiyu Wu , Xing Zheng , Huangsheng Cheng , Xiaorong Shi , Jing Guo This is my paper · ORCID
classification cs.CR
keywords skillbackdoorsself-evolvingagentsexperience-to-skillpipelinememorypoisoningextractionsanitizationwhitewashingpersistenceisolationLLMagentsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a new class of attack exists: instead of poisoning the memory or context an agent reads, an attacker can poison the experience records an agent learns from, and the agent's own skill-extraction machinery will compile those records into persistent, reusable skills. The authors call this attack SkillJack and argue it has three properties: extraction hides the malicious intent (sanitization whitewashing), a transient experience becomes a permanent capability (cross-layer promotion), and deleting the original poisoned record does not remove the derived skill (persistence isolation). If true, it means self-improving agents that turn interaction logs into skills are vulnerable at a deeper layer than previously thought, and that cleaning up memory is no longer enough to remove an implanted behavior.

What carries the argument

The central object is the experience-to-skill pipeline, formalized as a four-stage load-transform-persist-route process that maps an experience record to a structured skill with a name, description, and code. The key mechanism is the transformation-resilient payload, a poisoned trajectory written with legitimate-looking functional framing so that extraction preserves the policy-relevant action while emitting benign-looking metadata. This framing is what produces sanitization whitewashing, because the LLM-driven transformation strips overtly malicious wording and normalizes the action into a plausible procedure.

What would settle it

Run the exact same 150-trajectory dataset and attack through a different extraction model and a different LLM judge: if the detection drop from raw trajectories to extracted skills substantially narrows, or if the routed skills no longer trigger the policy-violation proxy, then SkillJack's quantified claims would not generalize beyond the single evaluated model configuration.

Watch

Extended reading notes

Core claim

The paper's central claim is that poisoned experiences can be transformed by the agent itself into durable behavioral artifacts. In the evaluated SkillX pipeline, an LLM judge flags 98.5% of raw poisoned trajectories but only 11.4% of the skills extracted from them; in the Anything2Skill system detection falls from 100.0% to 44.4% in document mode. The extracted skills remain effective, triggering the policy-violation proxy for 56.2% of attack-oriented tasks on SkillX and 89.2% on Anything2Skill, and 80.0% of skill-mediated triggers persist after the source trajectories are deleted. The authors propose transformation-resilient payloads, trajectories framed as legitimate operations such as 'backup' or 'archive', as the mechanism that lets malicious actions survive extraction while appearing benign.

Load-bearing premise

The weakest load-bearing premise is that the single LLM configuration used for extraction, routing, and judgment — DeepSeek-v4-flash — is representative enough that the measured whitewashing, triggering, and persistence numbers describe the paradigm rather than one model's behavior.

Editorial extensions

If this is right

  • If the central claim is correct, clearing a poisoned memory or experience store no longer removes the attack, because the derived skill persists in a separately stored library.
  • Safety checks calibrated on raw trajectories or memories cannot be assumed to transfer to extracted skills; detection must be repeated at every artifact boundary.
  • Skill libraries become a new attack surface that is routable, meaning future queries can select the implanted skill without ever re-reading the original poisoned record.
  • Defenses that stack static review and runtime monitoring may interfere rather than compose, so layered defenses need to be designed jointly.
  • The attack generalizes across at least two independently implemented experience-to-skill systems, suggesting the risk is a property of the paradigm rather than of one implementation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper does not fully test is whether the whitewashing effect shrinks or disappears when a stronger or differently-aligned extractor or judge is used, since all measurements rely on a single LLM configuration.
  • If SkillJack transfers to other experience-learning mechanisms, such as reflection-based memory or tool synthesis, then any persistent artifact derived from untrusted experience could carry a similar hidden risk, not just explicit skills.
  • The clean-task collateral triggering observed in the paper implies that a defender cannot rely on an implanted skill firing only in its intended context, which could either aid detection or widen the blast radius depending on the attacker's goal.
  • A concrete testable extension would be to run the same 150-trajectory dataset through several different models and extraction pipelines to see whether the 98.5%-to-11.4% drop in detection is a robust phenomenon or an artifact of one model's judgment.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces SkillJack, an attack that exploits the experience-to-skill pipelines of self-evolving agents. The attacker injects a poisoned trajectory; the agent's own pipeline compiles it into a reusable skill that is less detectable, routable to future tasks, and persistent after the source record is deleted. The authors evaluate on two systems, SkillX and Anything2Skill, using a shared dataset of 150 trajectories, and report three properties: sanitization whitewashing (LLM-judge detection drops from 98.5% on raw trajectories to 11.4% on extracted skills), cross-layer promotion (routing-level trigger rates of 56.2% and 89.2% on the two systems), and persistence isolation (80.0% of skill-based triggers survive source deletion). All effectiveness metrics are computed with a policy-violation proxy consisting of regexes and a DeepSeek-v4-flash LLM judge; the paper explicitly labels these as routing-level surrogates, not live-compromise rates.

Significance. If the empirical claims hold, SkillJack identifies a genuinely new attack surface: the transition from experience to skill in self-evolving agents, with implications for provenance-aware skill lifecycle defenses. The paper has notable strengths: a paired experimental design that separates framing from overt wording, a metadata ablation showing judge sensitivity to surface descriptions, evaluation on two independently implemented systems, transparent discussion of the proxy-based methodology, and public code. However, the central claim of 'durable behavioral artifacts' is supported only by proxy labels, not by executed behavior, and the single-model design weakens the cross-system generality claim. These are load-bearing concerns that require either additional execution-level evidence or a tempering of the paper's stated conclusions.

major comments (3)
  1. [§4.1, Table 3, Abstract] The headline numbers (98.5% to 11.4%, 56.2%, 89.2%, 80.0%) are all computed with the policy-violation proxy described in §4.1 (regexes plus DeepSeek-v4-flash LLM judge). The abstract states these as 'attack success rates' and 'durable behavioral artifacts,' but the paper itself notes they are 'routing-level surrogates, not live-compromise rates.' Because the judge is shown in §4.8 to key heavily on metadata, the proxy could both over- and under-approximate real policy violations. Please add a sandboxed execution study on a representative subset (e.g., the four case-study categories in Appendix C) in which the derived skills are actually run and their side effects are measured, and report the agreement between proxy classifications and executed outcomes. If live execution is not feasible, revise the abstract and conclusion to state plainly that the results are proxy-based and demonstrate a potential for durable artifacts, not demonstrated behavioral compromise.
  2. [§4.1, §4.4, §5.1] The cross-system generality claim is weakened by the use of a single model, DeepSeek-v4-flash, for all extraction, routing, judgment, and agent reasoning in both SkillX and Anything2Skill. The two systems are therefore not independent validations of the paradigm; a different model could behave differently in the extractor or the judge, changing the whitewashing, triggering, and persistence rates. Please evaluate at least one additional model (e.g., a different commercial API or an open-weight model) for the extraction-stage whitewashing and downstream routing experiments, or explicitly restrict the generality claim to the tested configuration.
  3. [§4.5, §4.6, Figures 3 and 4] Several sample sizes are small, and the paper does not report confidence intervals or statistical tests for the headline rates. In §4.5, the persistence rate of 80.0% is based on 10 skill-based triggers (8 of 10); in §4.6, the clean-task trigger rate of 20.0% is based on 15 tasks, and per-category rates such as unauthorized transfer at 28.6% have wide intervals. Since these rates are central to the cross-layer promotion and persistence claims, provide confidence intervals or exact binomial tests for the main rates, and report the number of tasks per category in Figure 4.
minor comments (6)
  1. [§4.1] The phrase 'the model is an implementation detail, and our conclusions have not yet been replicated across models' reads as an assertion rather than a limitation; please rephrase to acknowledge that the single-model design is a current boundary of the empirical evidence.
  2. [§4.1, Table 5] Clarify the relationship between the 505 extracted skills and the 356-skill routing library; the current text says the former refers to the two SkillX poisoned extraction sets, but it is easy to misread as a single shared library.
  3. [Figure 3] The y-axis label is 'Trigger rate (%)' but the figure also plots persistence and post-deletion rates; consider a more descriptive caption or a secondary axis label to avoid confusion.
  4. [§4.8] Clarify why the metadata ablation uses 30 skills for the LLM judge and 50 skills for pattern matching; the differing sample sizes are not explained.
  5. [Appendix A.4] The runtime monitor signature list is a hand-crafted free parameter, and the defense results are conditional on it; the paper already states this for the expanded set, but it should also be stated for the original 16-signature list.
  6. [Throughout] Standardize the spelling of 'Anything2Skill' (the text alternates between 'Anything2Skill' and 'A2S'); also check for minor typos such as 'we release this as a technical report' in §5.4, which seems to state the obvious.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack claims are empirically measured through third-party experience-to-skill pipelines, with surrogate-status and post-hoc-tuning limitations explicitly disclosed.

full rationale

The central claims are not derived from their own inputs. SkillJack is evaluated on two third-party systems, SkillX [14] and Anything2Skill [10], whose extraction and routing code is used unchanged; the attack only supplies trajectories. No uniqueness theorem or load-bearing result is imported from the authors' own prior work: their self-citations ([19], [20]) appear only in Related Work and are not used to justify any premise. The paper explicitly frames its headline quantities as proxies rather than as fitted predictions: 'A task counts as triggered when the routed skill satisfies this proxy; consequently, all trigger rates and ASR figures in this section are routing-level surrogates, not live-compromise rates.' This is a disclosed limitation on external validity, not a circular reduction. The supplementary code check is likewise labeled 'code-generation verification, not execution against live external services.' The only fitting-like step is the expansion of the runtime-monitor signature list in Section 4.9, and the paper states plainly: 'Because these signatures were added after observing the failures, the A2S reduction reflects post-hoc tuning rather than an a-priori defense.' That admission concerns an exploratory defense study, not the central attack claim, and it does not define a predicted quantity in terms of a fitted parameter. The formal objective in Equation (1) is a definition of the attacker's goal, not a derivation of the results. Single-model configuration (DeepSeek-v4-flash) is a generalization risk, not circularity. No claim in the paper reduces, by construction or by self-citation, to its own inputs.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

No numeric free parameters are central to the attack itself; the framing vocabulary and defense signature lists are hand-designed but not fitted constants of the target result. The empirical claims rest on representativeness assumptions about LLM extraction, the attacker threat model, and the proxy detectors. No new physical or technical entities are postulated; the three named properties are empirical descriptions, not invented mechanisms.

free parameters (1)
  • Runtime monitor signature list (D2) = 54 regex patterns (16 initial plus 38 added)
    The enhanced list was expanded after observing A2S DOC-mode failures, so the measured defense reduction (85.0% to 20.0%) incorporates post-hoc tuning disclosed in Section 4.9 and Appendix A.4. This is not a fitted constant for the central attack claim.
assumptions (4)
  • domain assumption An attacker can cause a poisoned experience record to enter the learning corpus through channels such as indirect content injection, a shared experience pool, or a compromised trajectory dataset.
    Threat model in Section 2.2; consistent with the broader memory-poisoning literature, but the specific channels are not independently verified in a deployment setting.
  • domain assumption DeepSeek-v4-flash is representative of LLMs used in experience-to-skill pipelines for extraction, routing, and safety judgment.
    Section 4.1 states that all extraction, routing, judgment, and agent reasoning use this model and that the conclusions have not yet been replicated across models.
  • domain assumption The policy-violation proxy (pattern regexes plus an LLM judge) approximates real security impact and real safety detection.
    Sections 4.1 and 5.4 state that trigger rates are routing-level surrogates rather than live-compromise rates and that no action was executed against external services.
  • domain assumption Functional framing around policy-relevant actions will survive LLM extraction without being filtered or made overtly suspicious.
    This is the core hypothesis of Section 3.2; the experiments support it for two pipelines under one model, but it is not established as a general invariant across extractors or models.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SkillJack: Persistent Skill Backdoors in Self-Evolving Agents." pith.science (2026). https://pith.science/paper/UB5NTZGK

@misc{pith2026260803509,
  author       = {Pith},
  title        = {Pith review of: SkillJack: Persistent Skill Backdoors in Self-Evolving Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UB5NTZGK}},
  note         = {Machine review of arXiv:2608.03509}
}
read the original abstract

Self-evolving agents increasingly convert interaction histories into reusable skills that persist beyond individual tasks. While prior work studies memory and retrieval poisoning, such attacks only affect agents when poisoned records are retrieved as context. We uncover a new and more fundamental risk: poisoned experiences can be transformed by the agent itself into durable behavioral artifacts. We present \textbf{SkillJack}, the first attack that exploits the experience-to-skill pipeline of self-evolving agents. Instead of directly manipulating runtime context, SkillJack hijacks the agent's own learning process to implant malicious behaviors into its reusable skill repertoire. We identify three key properties of this transformation: \emph{sanitization whitewashing}, where malicious intent is obscured during skill extraction; \emph{cross-layer promotion}, where transient experiences become persistent capabilities; and \emph{persistence isolation}, where the attack survives removal of its original source records. We evaluate SkillJack on two representative systems, SkillX and Anything2Skill, using a shared dataset of 150 trajectories across four policy-risk categories. Results show that skill extraction substantially reduces attack detectability: in SkillX, safety detection drops from 98.5\% for poisoned trajectories to 11.4\% for extracted skills, while Anything2Skill shows a similar effect. Meanwhile, the implanted skills remain effective, achieving attack success rates of 56.2\% and 89.2\% on the two systems, respectively. Furthermore, 80.0\% of skill-mediated attacks persist after deleting the original poisoned records, and some skills unintentionally activate on benign queries. Our findings reveal skill evolution as a new attack surface and motivate provenance-aware skill lifecycle protection. Our code is available at https://github.com/Tencent/AI-Infra-Guard/research/skilljack.

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 11 linked inside Pith

  1. [1]

    Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases.Advances in Neural Information Processing Systems, 37:130185–130213, 2024

    2024

  2. [2]

    P . Dash, T. Ge, A. Jain, T. Shah, and Z. Shang. From untrusted input to trusted memory: A systematic study of memory poisoning attacks in llm agents.arXiv preprint arXiv:2606.04329, 2026

    arXiv 2026

  3. [3]

    Debenedetti, J

    E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tramèr. Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents.Advances in neural information processing systems, 37:82895–82920, 2024

    2024

  4. [4]

    S. Dong, S. Xu, P . He, Y. Li, J. Tang, T. Liu, H. Liu, and Z. Xiang. Memory injection attacks on llm agents via query-only interaction.Advances in Neural Information Processing Systems, 38:46697–46731, 2026

    2026

  5. [5]

    T. Gu, B. Dolan-Gavitt, and S. Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain.arXiv preprint arXiv:1708.06733, 2017. 15

    arXiv 2017

  6. [6]

    Y. Louck. Securing llm-agent long-term memory against poisoning: Non-malleable, origin- bound authority with machine-checked guarantees.arXiv preprint arXiv:2606.24322, 2026

    arXiv 2026

  7. [7]

    Q. Mi, Z. Ma, M. Yang, H. Li, Y. Wang, H. Zhang, and J. Wang. Skill-pro: Learning reusable skills from experience via non-parametric ppo for llm agents.arXiv preprint arXiv:2602.01869, 2026

    arXiv 2026

  8. [8]

    J. Ni, Y. Liu, X. Liu, Y. Sun, M. Zhou, P . Cheng, D. Wang, E. Zhao, X. Jiang, and G. Jiang. Trace2skill: Distill trajectory-local lessons into transferable agent skills.arXiv preprint arXiv:2603.25158, 2026

    arXiv 2026

Show all 22 references
  1. [9]

    T. OWASP . for agentic applications (2026).Owasp top, 10, 10

    2026

  2. [10]

    Q. Pan, Y. Yang, J. Li, J. Zhou, K. Chen, X. Li, Q. Chen, and L. He. Anything2skill: Compiling external knowledge into reusable skills for agents.arXiv preprint arXiv:2606.09316, 2026

    2026 arXiv

  3. [11]

    Shafahi, W

    A. Shafahi, W. R. Huang, M. Najibi, O. Suciu, C. Studer, T. Dumitras, and T. Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks.Advances in neural information processing systems, 31, 2018

    2018

  4. [12]

    S. S. Srivastava and H. He. Memorygraft: Persistent compromise of llm agents via poisoned experience retrieval.arXiv preprint arXiv:2512.16962, 2025

    2025

  5. [13]

    Trivedi, T

    H. Trivedi, T. Khot, M. Hartmann, R. Manku, V . Dong, E. Li, S. Gupta, A. Sabharwal, and N. Balasubramanian. Appworld: A controllable world of apps and people for benchmark- ing interactive coding agents. InProceedings of the 62nd Annual Meeting of the Association for Computat...

    2024

  6. [14]

    C. Wang, Z. Yu, X. Xie, W. Yao, R. Fang, S. Qiao, K. Cao, G. Zheng, X. Qi, P . Zhang, et al. Skillx: Automatically constructing skill knowledge bases for agents.arXiv preprint arXiv:2604.04804, 2026

    2026 arXiv

  7. [15]

    K. Wang, J. Lou, Z. Zhou, and J. Li. Oep: Poisoning self-evolving llm agents via locally correct but non-transferable experiences.arXiv preprint arXiv:2605.18930, 2026

    2026 arXiv

  8. [16]

    Z. Z. Wang, J. Mao, D. Fried, and G. Neubig. Agent workflow memory.arXiv preprint arXiv:2409.07429, 2024

    2024 arXiv

  9. [17]

    W. Xu, Z. Liang, K. Mei, H. Gao, J. Tan, and Y. Zhang. A-mem: Agentic memory for llm agents.Advances in Neural Information Processing Systems, 38:17577–17604, 2026

    2026

  10. [18]

    Y. Yang, J. Li, Q. Pan, B. Zhan, Y. Cai, L. Du, J. Zhou, K. Chen, Q. Chen, X. Li, et al. Autoskill: Experience-driven lifelong learning via skill self-evolution.arXiv preprint arXiv:2603.01145, 2026

    2026

  11. [19]

    Z. Ying, H. Wang, J. Liu, Q. Zou, A. Liu, J. Yang, Y. Yang, and X. Liu. Agentvisor: De- fending llm agents against prompt injection via semantic virtualization.arXiv preprint arXiv:2604.24118, 2026

    2026 arXiv

  12. [20]

    Q. Zhan, Z. Liang, Z. Ying, and D. Kang. Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents. InFindings of the Association for Computational Linguistics: ACL 2024, pages 10471–10506, 2024

    2024

  13. [21]

    A. Zhao, D. Huang, Q. Xu, M. Lin, Y.-J. Liu, and G. Huang. Expel: Llm agents are experiential learners. InProceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 19632–19642, 2024. 16

    2024

  14. [22]

    backup”, “archive

    W. Zou, M. Dong, M. R. Calvo, S. Chang, J. Guo, D. Lee, X. Niu, X. Ma, Y. Qi, and J. Jiang. Poison once, exploit forever: Environment-injected memory poisoning attacks on web agents.arXiv preprint arXiv:2604.02623, 2026. A. Experiment Configuration Details A.1. Payload Templat...

    2026 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.