REVIEW 4 major objections 5 minor 29 references
When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems
T0 review · 4 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash
Pith's one-line read A skill-visible black-box attacker who contributes only 10% of trajectory evidence can make self-evolving skill systems write harmful behavior into persistent skills in 91% of trials on SkillClaw and 61.5% on Trace2Skill.
desk verdict A genuine new poisoning surface at the evidence-to-instruction boundary, carefully measured, but the headline SER depends on a stripped SkillClaw configuration with native quality gates untested. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central machinery is the attribution-oriented trajectory transformation T(τ; s, b): domain-aligned inclusion places the target behavior at a workflow locus where an evolver expects reusable expertise; causal binding ties it to the observed task outcome so the evolver credits it as a skill-worthy pattern; cross-trajectory invariance reproduces the same operational semantics across varying tasks so the behavior survives summarization and merge. These three properties map directly onto the C1–C3 conditions and are what let a victim evolver author the poisoned skill artifact from ordinary-looking evidence.
What would settle it
Run the same attack with SkillClaw's session-quality judge and publish-time verifier enabled, and with attacker trajectories produced through a realistic contributor channel rather than converted from a completed SpreadsheetBench log corpus; if SER under those conditions drops below the reported 91.0%, the headline success is an artifact of disabled quality gates.
Extended reading notes
Core claim
PoisonedEvolution formalizes artifact poisoning as three necessary conditions: C1 Inclusion, C2 Evolution Attribution, and C3 Realization. The attacker's transformation preserves the original task and outcome while inserting behavior b at a plausible workflow locus with a causal bridge (obstacle/requirement → b → success, or missing b → failure). At n=30, k=3 (10% attacker support), this achieves a 91.0% skill embedding rate across six evolvers on SkillClaw and 61.5% on Trace2Skill, showing that the attack transfers across evolution architectures. Ablations show that a single poisoned trajectory is weak (5/25 at k=1) while k=2 reaches 21/25, and that causal outcome framing is necessary: local or fragmented insertions reach only 8/25 and 11/25 versus 25/25 with causal framing.
Load-bearing premise
The attack works only if the attacker can submit three consistent, normal-looking trajectories that the pipeline accepts as ordinary experience; the paper builds those trajectories from an existing completed-task log corpus and turns off two optional quality checks, so a real deployment with those checks on might reject them.
Editorial extensions
If this is right
- At 10% attacker support, adversarial trajectories become persistent skill instructions in 91% of SkillClaw trials and 61.5% of Trace2Skill trials.
- A single poisoned trajectory is weak (5/25 at k=1), while k=2 raises success to 21/25; recurrence is the key lever attackers control.
- Causal outcome framing is necessary: local and fragmented insertions reach only 8/25 and 11/25, versus 25/25 with causal framing.
- Safety-weakening payloads (F4) transfer poorly to failure-routed pipelines (18.7% on Trace2Skill) but easily in SkillClaw (97.3%), so family sensitivity is pipeline-dependent rather than intrinsic.
- A pilot provenance-diversity gate rejecting single-cluster candidates dropped SER from 25/25 to 0/25 on the tested F1 candidates, indicating provenance-aware promotion is a promising defense direction.
Reading between the lines
- If a deployment enables SkillClaw's optional session-quality judge and publish-time verifier, the measured 91.0% SER could drop substantially, because the paper's main matrix disables those gates.
- Multi-cycle evolution could amplify a single successful poisoning: agents following the poisoned skill would generate later trajectories that repeat the behavior, which the evolver could then treat as independent corroboration.
- An artifact-origin check cannot catch this attack by itself because the poisoned skill is genuinely authored by the victim evolver; lineage must track supporting trajectories and contributor clusters.
- Detectors tuned to one security-effect family will miss the same behavior embedded at a different workflow locus, as the F4 gap between SkillClaw and Trace2Skill illustrates.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper identifies evidence promotion in self-evolving skill (SES) systems as a security boundary and proposes PoisonedEvolution, in which a skill-visible black-box attacker contributes k transformed trajectories to a batch of n records. The attack defines success via three conditions: C1 Inclusion, C2 Evolution Attribution, and C3 Realization. The central empirical claims are SER of 546/600 (91.0%) across six evolvers in SkillClaw at rho=10% and 369/600 (61.5%) in the structurally different Trace2Skill pipeline. The paper also presents ablations isolating recurrence, causal framing, and behavioral encoding, a batch-size sensitivity check, a no-init skill-creation diagnostic, a benign-task utility check, and a pilot provenance-diversity defense.
Significance. If the results hold, this is a meaningful contribution: it distinguishes evidence-level trajectory poisoning from skill-file attacks and RAG poisoning, provides a clean three-condition formalization, and gives cross-pipeline transfer evidence. The evaluation has genuine strengths: SER is measured from generated artifacts against pre-registered canary rules rather than fitted to outcomes, trial denominators are reported as embedded/completed counts, and the attack parameters (k=3, n=30) are attacker choices rather than tuned hyperparameters. The ablations align with the proposed mechanism. However, the headline SkillClaw result is obtained with optional native quality gates disabled, so the claim is established only for a specific stripped configuration; this is the main load-bearing caveat.
major comments (4)
- [Empirical Evaluation, RQ1 (Table 1)] The headline SkillClaw result of 546/600 (91.0% SER) is obtained with SkillClaw's optional session-quality judge and publish-time verifier disabled, as stated in the evaluation setup, while C1 is 'held operationally fixed' by submitting attacker records through the native ingestion path. The paper's statement that these modules 'do not enforce source provenance' does not answer the relevant risk: as quality gates, they could reject the synthetic, canary-laden, k=3 repeated trajectories before the evolver sees them. The headline is therefore established only for a stripped configuration. Please measure SER with the native gates enabled (or report per-gate pass/fail counts), and qualify the abstract and RQ1 conclusion accordingly if the gates cannot be enabled for all cells.
- [RQ2 (Mechanism Ablations), Figures 2 and 3] The ablation claims rest on 25-trial cells with no uncertainty quantification. For example, the transition from k=1 (5/25) to k=2 (21/25) is reported as the key point, and the C3 'Auxiliary' cell is 0/25; a 95% binomial CI for 0/25 is approximately 0-13.7%, so the difference from 'Generic' (18/25) is real, but the absence of CIs makes the per-family contrasts hard to evaluate. Report exact binomial CIs or tests for the headline aggregate and for the key ablation contrasts, and avoid interpreting small cell differences as reliable without them.
- [RQ3 (Structural Transfer), Table 2] The 369/600 Trace2Skill result aggregates 150 trials per family across 'multiple evolvers and evolution modes' without reporting how the 600 trials are allocated or what the per-evolver/per-mode rates are. Since the claim is structural transfer, the aggregate could be driven by one configuration; please provide the allocation and per-condition rates so a reader can verify that the transfer is not an artifact of a single evolver or mode.
- [Metrics, Eq. (5), and C1 Inclusion] The SER metric is described as rule-based with an LLM judge for ambiguous cases, but the canary rules and judge prompts are not given in the manuscript, and C1 is never independently measured. Because the experiments directly place attacker records into the pool, C1 is assumed rather than verified; a reader cannot tell how many records would be rejected by native filters. Include the detection rules (or an artifact with them) and report filter pass rates so that the C1-C2-C3 decomposition is actually operationalized.
minor comments (5)
- [Evolution pipelines in our evaluation] The sentence 'Our experiments retain the core native decisions and prompts; only input trajectories change' is inaccurate given that two optional quality gates are disabled; please rephrase to state the configuration change explicitly.
- [Table 1] Consider adding 95% confidence intervals per row; 70/100 and 87/100 overlap at conventional 95% confidence, so the text's emphasis on evolver variation should be tempered unless the intervals are reported.
- [Figure 2] The 'k=1, n=100 check gives 0/5' is too small to support the phrase 'consistent with the same recurrence effect'; either increase the number of trials or soften the wording.
- [Discussion, pilot defense] The provenance-diversity pilot uses one five-session diverse control; the paper acknowledges this limitation, but the defense claim would be strengthened by a larger benign control set.
- [Reproducibility] The paper does not state whether code, canary rule sets, or judge prompts will be released; for a security result, an availability statement or appendix with the detection rules would aid reproduction.
Circularity Check
No significant circularity: the SER figures are measured outcomes from generated skill artifacts against pre-registered canary rules, and no load-bearing claim reduces to its inputs by construction.
full rationale
The derivation chain is empirical and self-contained. PoisonedEvolution formalizes artifact poisoning as C1∧C2∧C3, but the central claim (546/600 trials, 91.0% SER on SkillClaw; 369/600, 61.5% on Trace2Skill) is not an algebraic consequence of that definition. It is a measured outcome: each trial runs a real LLM evolver over a mixed pool of clean and attacker-controlled trajectories, and SER is scored by pre-registered, diff-aware canary rules applied to the generated skill artifact. The attack parameters (n=30, k=3, ρ=10%) are attacker choices, not fitted values, and the ablations show genuine sensitivity (k=1 reaches 5/25 vs 25/25 at k=3; local, fragmented, auxiliary, and generic encodings fail at 8/25, 11/25, 0/25, and 18/25), which is inconsistent with a success metric forced by construction. The one caveat that could threaten transfer—disabling SkillClaw's optional session-quality judge and publish-time verifier, without a measurement with those native gates enabled—is an external-validity limitation, not a circular step; the paper itself discloses this configuration and separately labels the provenance-diversity gate as a preliminary pilot. References to SkillClaw, Trace2Skill, SpreadsheetBench, and Skill-Inject are external prior work; no load-bearing premise is justified only by a self-citation. The claimed Evolution Attribution bottleneck is supported by controlled variation of trajectory representation, not by defining success in terms of attribution. No fitted parameter is relabeled as a prediction, and no output is equivalent to an input by construction.
Assumptions & free parameters
free parameters (2)
- Attacker support k =
3 (10% of n=30)
- Batch size n =
30 (dilution tested at n=100)
assumptions (4)
- domain assumption Self-evolving skill systems convert trajectory pools into persistent skill artifacts and treat recurring evidence as reusable experience.
- domain assumption An attacker can create legitimate user accounts or Sybil identities and contribute records to the shared trajectory pool.
- ad hoc to paper The attacker has access to realistic task-related reference trajectories and can rewrite them so behavior b appears as a causal bridge.
- domain assumption SkillClaw's optional quality gates do not affect the result or are disabled.
Cite this review
Pith. "Pith review of When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems." pith.science (2026). https://pith.science/paper/5V24RV5H
@misc{pith2026260805563,
author = {Pith},
title = {Pith review of: When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems},
year = {2026},
howpublished = {\url{https://pith.science/paper/5V24RV5H}},
note = {Machine review of arXiv:2608.05563}
}
read the original abstract
Self-evolving skill (SES) systems distill agent trajectories into persistent skills, allowing untrusted experience to become trusted instruction. We introduce PoisonedEvolution, a trajectory-poisoning attack on this promotion process. Our skill-visible black-box attacker can inspect a target skill and contribute bounded evidence, but cannot observe private pools or evolution logic or edit the skill bank. Artifact poisoning requires Inclusion, Evolution Attribution, and Realization. Attribution is the distinctive bottleneck: the target behavior must appear causally useful, recurrent, and generalizable before promotion. We evaluate four representative security-effect families using inert canary specifications. At 10% attacker support, across six mainstream LLM evolvers in SkillClaw, PoisonedEvolution embeds target behaviors in 546/600 trials (91.0% SER). On the structurally different Trace2Skill pipeline at the same ratio, it embeds target behaviors in 369/600 trials (61.5% SER), demonstrating transfer across evolution architectures. In a representative controlled study, three consistent attacker records suffice in a 30-record batch, whereas a single record is much weaker. Ablations identify recurring support, causal framing, and domain-aligned encoding as the main determinants of success. These findings expose evidence promotion as a security boundary for self-evolving agents.
Figures
Reference graph
Works this paper leans on
-
[1]
arXiv preprint arXiv:2604.08377 , year =
Ziyu Ma and Shidong Yang and Yuxiang Ji and Xucong Wang and Yong Wang and Yiming Hu and Tongwen Huang and Xiangxiang Chu , title =. arXiv preprint arXiv:2604.08377 , year =
-
[2]
arXiv preprint arXiv:2603.01145 , year =
Yutao Yang and Junsong Li and Qianjun Pan and Bihao Zhan and Yuxuan Cai and Lin Du and Jie Zhou and Kai Chen and Qin Chen and Xin Li and Bo Zhang and Liang He , title =. arXiv preprint arXiv:2603.01145 , year =
-
[3]
arXiv preprint arXiv:2603.25158 , year =
Jingwei Ni and Yihao Liu and Xinpeng Liu and Yutao Sun and Mengyu Zhou and Pengyu Cheng and Dexin Wang and Erchao Zhao and Xiaoxi Jiang and Guanjun Jiang , title =. arXiv preprint arXiv:2603.25158 , year =
-
[4]
arXiv preprint arXiv:2602.02474 , year =
Haozhen Zhang and Quanyu Long and Jianzhu Bao and Tao Feng and Weizhi Zhang and Haodong Yue and Wenya Wang , title =. arXiv preprint arXiv:2602.02474 , year =
-
[5]
arXiv preprint arXiv:2602.08234 , year =
Peng Xia and Jianwen Chen and Hanyang Wang and Jiaqi Liu and Kaide Zeng and Yu Wang and Siwei Han and Yiyang Zhou and Xujiang Zhao and Haifeng Chen and Zeyu Zheng and Cihang Xie and Huaxiu Yao , title =. arXiv preprint arXiv:2602.08234 , year =
-
[6]
Hanrong Zhang and Shicheng Fan and Henry Peng Zou and Yankai Chen and Zhenting Wang and Jiayu Zhou and Chengze Li and Wei-Chieh Huang and Yifei Yao and Kening Zheng and Xue Liu and Xiaoxiao Li and Philip S. Yu , title =. arXiv preprint arXiv:2604.01687 , year =
-
[7]
arXiv preprint arXiv:2604.10674 , year =
Hao Wang and Guozhi Wang and Han Xiao and Yufeng Zhou and Yue Pan and Jichao Wang and Ke Xu and Yafei Wen and Xiaohu Ruan and Xiaoxin Chen and Honggang Qi , title =. arXiv preprint arXiv:2604.10674 , year =
-
[8]
arXiv preprint arXiv:2605.27366 , year =
Huawei Lin and Peng Li and Jie Song and Fuxin Jiang and Tieying Zhang , title =. arXiv preprint arXiv:2605.27366 , year =
Show all 29 references
-
[9]
arXiv preprint arXiv:2602.12430 , year =
Renjun Xu and Yang Yan , title =. arXiv preprint arXiv:2602.12430 , year =
-
[10]
arXiv preprint arXiv:2604.09378 , year =
Guiyao Tie and Jiawen Shi and Pan Zhou and Lichao Sun , title =. arXiv preprint arXiv:2604.09378 , year =
-
[11]
Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec) , year =
Kai Greshake and Sahar Abdelnabi and Shailesh Mishra and Christoph Endres and Thorsten Holz and Mario Fritz , title =. Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec) , year =
-
[12]
arXiv preprint arXiv:2602.20156 , year =
David Schmotz and Luca Beurer-Kellner and Sahar Abdelnabi and Maksym Andriushchenko , title =. arXiv preprint arXiv:2602.20156 , year =
-
[13]
arXiv preprint arXiv:2603.22489 , year =
Charoes Huang and Xin Huang and Ngoc Phu Tran and Amin Milani Fard , title =. arXiv preprint arXiv:2603.22489 , year =
-
[14]
34th USENIX Security Symposium (USENIX Security 25) , pages =
Wei Zou and Runpeng Geng and Binghui Wang and Jinyuan Jia , title =. 34th USENIX Security Symposium (USENIX Security 25) , pages =
-
[15]
Advances in Neural Information Processing Systems , volume =
Zhaorun Chen and Zhen Xiang and Chaowei Xiao and Dawn Song and Bo Li , title =. Advances in Neural Information Processing Systems , volume =
-
[16]
Advances in Neural Information Processing Systems , year =
Shen Dong and Shaochen Xu and Pengfei He and Yige Li and Jiliang Tang and Tianming Liu and Hui Liu and Zhen Xiang , title =. Advances in Neural Information Processing Systems , year =
-
[17]
arXiv preprint arXiv:2604.02623 , year =
Wei Zou and Mingwen Dong and Miguel Romero Calvo and Shuaichen Chang and Jiang Guo and Dongkyu Lee and Xing Niu and Xiaofei Ma and Yanjun Qi and Jiarong Jiang , title =. arXiv preprint arXiv:2604.02623 , year =
-
[18]
arXiv preprint arXiv:2604.03081 , year =
Yubin Qu and Yi Liu and Tongcheng Geng and Gelei Deng and Yuekang Li and Leo Yu Zhang and Ying Zhang and Lei Ma , title =. arXiv preprint arXiv:2604.03081 , year =
-
[19]
arXiv preprint arXiv:2606.07943 , year =
Haochang Hao and Dehai Min and Zhifang Zhang and Yunbei Zhang and Miao Xu and Yingqiang Ge and Lu Cheng , title =. arXiv preprint arXiv:2606.07943 , year =
-
[20]
arXiv preprint arXiv:2604.22888 , year =
Wenjie Xiao and Xuehai Tang and Biyu Zhou and Songlin Hu and Jizhong Han , title =. arXiv preprint arXiv:2604.22888 , year =
-
[21]
Advances in Neural Information Processing Systems , year =
Zeyao Ma and Bohan Zhang and Jing Zhang and Jifan Yu and Xiaokang Zhang and Xiaohan Zhang and Sijia Luo and Xi Wang and Jie Tang , title =. Advances in Neural Information Processing Systems , year =. 2406.14991 , archivePrefix =
-
[22]
arXiv preprint arXiv:2404.13208 , year =
Eric Wallace and others , title =. arXiv preprint arXiv:2404.13208 , year =
-
[23]
arXiv preprint arXiv:2410.05451 , year =
Sizhe Chen and Arman Zharmagambetov and Saeed Mahloujifar and Kamalika Chaudhuri and David Wagner and Chuan Guo , title =. arXiv preprint arXiv:2410.05451 , year =
-
[24]
arXiv preprint arXiv:2503.18813 , year =
Edoardo Debenedetti and Ilia Shumailov and Tianqi Fan and Jamie Hayes and Nicholas Carlini and Daniel Fabian and Christoph Kern and Chongyang Shi and Andreas Terzis and Florian Tram\`er , title =. arXiv preprint arXiv:2503.18813 , year =
-
[25]
28th USENIX Security Symposium (USENIX Security 19) , pages =
Santiago Torres-Arias and Hammad Afzali and Trishank Karthik Kuppusamy and Reza Curtmola and Justin Cappos , title =. 28th USENIX Security Symposium (USENIX Security 19) , pages =
-
[26]
2025 , note =
Anthropic , title =. 2025 , note =
2025
-
[27]
2025 , note =
Vercel , title =. 2025 , note =
2025
-
[28]
2025 , note =
Smithery , title =. 2025 , note =
2025
-
[29]
C. J. Clopper and E. S. Pearson , title =. Biometrika , volume =
Reviewed August 8, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.