Pith. sign in

REVIEW 5 major objections 6 minor 42 references

ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single maliciously crafted agent-skill file can carry a conditional backdoor that stays dormant in normal use and fires only when an attacker-controlled trigger phrase appears in the user request.

desk verdict Novel and plausible conditional single-skill backdoor, but the near-zero FPR claim is undercut by the paper's own cross-task experiment; deserves major revision, not rejection. read the letter →

arxiv 2608.09577 v1 pith:ENFNMLEU submitted 2026-08-10 cs.AI

Hao Sui , Simeng Qin , Jie Liao , Xiaojun Jia , Bing Chen , Yang Liu This is my paper · ORCID
classification cs.AI
keywords LLMagentskillsconditionalbackdoortrigger-as-switchskillsupplychainpoisoninggeneticsearchstealthoptimizationdeployment-timedefenses
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that an attacker who can publish one agent skill can plant a conditional, weight-free backdoor that remains dormant on ordinary queries and executes a malicious payload only when a co-optimized trigger phrase and a gated rule in the instruction file co-occur. It matters because agent skills are adopted almost verbatim from open supply chains, so a single skill can reach many agents, and existing defenses inspect skills at rest or on benign queries. The paper claims ElasticBack is the first conditional single-skill attack to achieve this without fine-tuned weights or multiple skills, and reports high attack success at near-zero false-positive rate with preserved clean accuracy across four agent LLMs and three target behaviors. If right, the effective security question shifts from detecting malicious text in skill files to controlling what runtime channels can carry a trigger.

What carries the argument

The load-bearing mechanism is the trigger-as-switch construction: a payload-derived gate-word set $G$ links a document-side conditional rule $R$ and a query-side trigger $T$ so that the trigger is the sole switch that turns the payload on. The rule is generated in a canonical conditional form, “When $C$, invoke $s$ to $Z$, then produce $\delta$; otherwise proceed normally,” using literal-match condition verbs, at least one gate word, and a negative-scope clause that protects benign behavior, and it is inserted at a low-salience position chosen from an attention-guided saliency map. The trigger is evolved by C-HGA, a constrained genetic algorithm seeded with the gate words and expanded with benign shadow tokens, whose fitness combines estimated attack success with a stealth term made of semantic fit, rule–trigger similarity, and a dependency-attachment score, followed by deterministic syntactic repair and LCB selection.

What would settle it

Re-run each poisoned skill against a large corpus of naturally occurring, benign user requests in the skill's domain, or against many diverse paraphrases of the skill's tasks instead of one hand-picked query per skill, and count how often the payload fires; if the false-positive rate rises materially above the reported near-zero level on realistic traffic, the trigger-as-switch gate is not switch-like in practice.

Watch

Extended reading notes

Core claim

The central claim is that a backdoor can be encoded entirely in a skill artifact, a natural-language rule $R$ in Skill.md plus a benign-looking trigger $T$ delivered through channels the skill governs, with no weight modification and no retraining. The two sides are bound by a trigger-as-switch construction: a small set of payload-unique gate words $G$, mined as terms in the payload vocabulary semantically far from the skill's core with a similarity threshold $ heta_g = 0.60$, seeds the rule's activation condition and anchors trigger evolution. With the rule frozen after a behavioral probe, a stealth-constrained genetic search called C-HGA evolves the trigger against that rule, and a lower-confidence-bound selection picks the deployed trigger. Across three target behaviors, each run on 50 skills, and four agent LLMs, the paper reports an average attack success rate of 89%, a false-positive rate of 6%, a clean-accuracy drop of 3%, and defense evasion rates of 82–86% against perplexity screening, 74–78% against LLM-judge auditing on two behaviors, and 98–100% against behavioral monitoring.

Load-bearing premise

The near-zero false-positive rate rests on the assumption that the distinctive words tied to the malicious payload never occur naturally in real benign user requests, so the hidden rule is never accidentally tripped.

Editorial extensions

If this is right

  • A single poisoned skill can persistently redirect every agent that installs it, with no access to model weights and no runtime cost after publication.
  • Static inspection of the skill text and behavioral monitoring on benign queries will not catch the backdoor, because the rule reads as an optional capability and never fires without the trigger.
  • The attack transfers across victim models from a different surrogate family, so defense cannot assume the attacker needs the same model as the victim.
  • Because the trigger travels through skill-governed channels such as example prompts and tool or retrieval outputs, securing those channels is part of the defense surface.
  • The paper's own cross-task test shows the gating is calibrated to the source task: on non-source task instructions, attack success falls to 76.6–83.2% while false positives rise to 12.4–15.8%, though activation still separates from misfire.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: because the rule is deliberately written to read like an ordinary capability, text-level review is unlikely to be the primary defense; execution-level isolation such as sandboxing and capability approval, plus provenance for skill artifacts, is the more direct mitigation.
  • Beyond the paper: the gate threshold $\theta_g$ is the key control knob, and the evaluation that sweeps it shows a single-peaked attack success at $0.6$; a defender could map the attack's real operating envelope by sweeping this threshold against realistic benign traffic.
  • Beyond the paper: the same coupling could be repurposed defensively, scanning skill documents for payload-like gate words and then monitoring user-side text for their co-occurrence, which would turn the trigger-as-switch mechanism into a detection signature.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes ElasticBack, a conditional single-skill backdoor attack against LLM-agent skills. The attacker inserts a gated rule R into Skill.md and a natural-language trigger T into the user query, with R and T coupled through payload-derived gate words G. The payload is supposed to fire only when both the trigger and the rule condition co-occur, while benign queries leave the skill dormant. The authors describe a semantic-anchored rule injection step and a stealth-constrained genetic search (C-HGA) for trigger evolution. They evaluate the method on three target behaviors with 50 skills each, four agent LLMs, three attack baselines, and three defenses, reporting high attack success rate (ASR), near-zero false-positive rate (FPR), preserved clean accuracy, cross-model transfer, and defense evasion. The paper also includes ablations and hyperparameter sensitivity studies.

Significance. If the central claims held, ElasticBack would be a notable contribution: it identifies a realistic supply-chain attack surface that is weight-free, single-skill, and conditional, and it provides a concrete mechanism (gate-word anchoring plus coupled trigger-rule optimization) that is more sophisticated than the always-on injection baselines. The cross-surrogate and cross-task experiments, together with the component ablations, are valuable steps toward understanding when such backdoors generalize. However, the paper's headline claims outrun the evidence: the 'near-zero FPR' rests on a single hand-picked benign query per skill, and the paper's own cross-task experiment reports FPR around 12-16% on broader benign instructions. The behavioral oracle that determines whether the payload fires is never described, and the statistical protocol provides no confidence intervals or repeated runs. These issues directly affect the main advertised properties (dormancy and precision), so the contribution is currently a promising attack design rather than a fully established one.

major comments (5)
  1. [§5.1, Fig. 4] The central 'near-zero false-positive rate' claim is not supported by the evaluation protocol. In §5.1, each skill is tested with exactly one benign query, selected from the skill's own in-domain examples, so the reported FPR is an estimate over 50 hand-picked queries and cannot characterize how often the gate condition C in Eq. (4) is satisfied by real user traffic. This is directly contradicted by the paper's own Fig. 4b, where the same poisoned skills, when evaluated on 20 LLM-generated task instructions, show FPR of 12.4-15.8% on the GLM-5.2 victim, versus 0-2% on the source query. Since §3.1 states that the attacker cannot observe victim queries at deployment, a single-query FPR does not transfer to a distribution. The authors should report FPR over a broader and more realistic corpus of benign task instructions, with confidence intervals, and either reconcile the cross-task numbers with the abstract's 'without affecting normal tasks' or substantially weaken the claimed dormancy property.
  2. [§4.3, Eq. (5), §5.1] The 'behavioral oracle' that decides whether the agent invoked the payload is never described. Eq. (5) evaluates each candidate trigger with a behavioral oracle that checks whether the agent invokes script s, and §5.1 states that ASR/FPR are measured by whether the payload fires, but the manuscript does not specify how this is determined: is it by reading tool-call logs, by checking file-system side effects, or by an LLM judge? The exact detection criterion is load-bearing for all reported ASR and FPR numbers, and without it the evaluation is not reproducible. The authors should define the oracle precisely and, if it is itself an LLM, discuss the risk of circularity or proxy error.
  3. [§5.1] The statistical reporting is inadequate for the strength of the claims. Every reported rate is based on one triggered query and one benign query per skill, with no confidence intervals, no repeated runs, and no variation of decoding settings. The statement 'as decoding is deterministic (temperature=0), per-query outcomes are fixed' is an unverified assumption: temperature-0 sampling in modern LLM APIs is not a formal guarantee of determinism, and even deterministic decoding can be sensitive to prompting order and batching. Differences of 2-4 percentage points between rows in Table 1 are therefore within the noise of the protocol. The authors should report repeated runs, confidence intervals or error bars, and ideally multiple benign queries per skill.
  4. [Table 1, Fig. 3] The GLM-5.2 rows in Table 1 are in-sample results, because GLM-5.2 is the default surrogate used to optimize both the rule and the trigger. Those ASR/FPR values are outcomes of the optimization, not independent predictions. The cross-surrogate experiment in Fig. 3 provides some independent evidence, but it is limited to two victims and only reports ASR/FPR without the corresponding ∆CAC. To support 'transfers across models,' the authors should report out-of-sample performance for all four victims when the surrogate is GLM-5.2 and for at least one additional surrogate-victim pair, with confidence intervals.
  5. [§5.1, Table 3] The defense-evasion evaluation for Behavioral Monitoring is largely circular with the single-query FPR protocol. The monitor is described as running skills on benign queries and flagging any whose payload fires, so if FPR is measured on one hand-picked benign query per skill, an evasion rate of 98-100% is a direct consequence of the near-zero FPR measured on those same queries. The defense should be evaluated on a diverse set of benign instructions (e.g., the 20-task corpus from Fig. 4) to determine whether the backdoor actually stays dormant under realistic monitoring. Similarly, the LLM-as-Judge Audit setup is underspecified: which judge model, what system prompt, and how many audit attempts?
minor comments (6)
  1. [Table 2] The table caption says 'Attack stealthiness of ElasticBack (%)', but Cos-Sim and MMD are not percentages; please correct the caption or the units.
  2. [Eq. (5)] The formula for F(T) has an unbalanced bracket: it reads 'F(T) = α [ASR(T) + λStealth(T) − Π(T)' without a closing bracket. Please fix the typo and ensure the operator precedence is clear.
  3. [Eq. (1)] The notation CACclean is used in the definition of ∆CAC but is never formally defined; please define it explicitly (presumably the benign solver rate on the clean skill before the rule is inserted).
  4. [§5.2] The sentence 'FPR never exceeds one benign query' is confusing because FPR is a percentage, not a count; please rephrase to say that the FPR corresponds to at most one out of the 50 benign queries firing.
  5. [Table 4] The row label 'Imperative' for Rule R is ambiguous; it appears to denote an unconditional imperative form without the conditional structure. Please rename it (e.g., 'Unconditional imperative R') to avoid confusion with the conditional imperative used in ElasticBack.
  6. [§5.1, Dataset] The dataset is described as curated from ClawHub, but the footnote 'https://clawhub.ai/skills' should be accompanied by a retrieval date and, if possible, a version or hash so that the experiments are reproducible.

Circularity Check

2 steps flagged · score 6.0 of 10

Near-zero FPR is a calibration artifact of the source benign query, and GLM-5.2 headline rows are in-sample surrogate optima; cross-model/cross-surrogate results provide independent grounding.

  1. fitted input called prediction [§4.2 Rule finalization; §5.1 Evaluation setup; §5.2 Cross-task Instruction Transferability]
    "a behavioral probe scores each candidate with a stand-in trigger derived from C and on benign queries. We keep the candidate with the largest margin between activation and benign misfires, and freeze it ... each skill receiving one triggered query (for ASR) and one benign query (for FPR, CAC) ... The trade-off is a higher FPR of 12.4–15.8% (at most 2% on the source task), as the gate is calibrated to that task."

    The rule R is selected by a behavioral probe that measures benign misfires on the skill's in-domain queries, and the final FPR is then measured on one benign query drawn from those same originals (the 'primary pool' used for final metrics). The near-zero FPR on the source task is therefore the outcome of fitting R to that query, not an independent estimate for benign requests. The paper's own cross-task test, using 20 LLM-generated instructions, reports FPR 12.4–15.8%, confirming that the gate is calibrated to the source task. Presenting 'near-zero false-positive rate' and 'dormant on benign inputs' as general properties is the fitted value renamed as a prediction.

  2. fitted input called prediction [§5.1 Victim environment; §5.2 Cross-surrogate Transferability; Table 1]
    "The attack effectiveness shown in Table 1 is obtained by using GLM-5.2 as the surrogate to generate the trigger and the conditional rule, and deploying on the four victim models."

    For the GLM-5.2 victim rows in Table 1, the victim is identical to the surrogate used to evolve T and select R, so ASR and FPR are in-sample values of the C-HGA objective F(T)=α[ASR(T)+λStealth(T)]−Π(T), not held-out transfer predictions. The abstract summarizes performance across 'four agent LLMs' without separating the surrogate row from the genuinely transferred rows. The cross-surrogate and cross-model rows provide independent evidence, so this is partial, not total, circularity.

full rationale

The paper's contribution is an attack construction, and most of its claimed behaviors are verified empirically rather than derived. The cross-surrogate (MiniMax-M3) and cross-task experiments, plus defense evaluations against external detectors, give independent content that does not reduce to the paper's inputs. However, two central numbers are in-sample by construction. First, R is selected to maximize the activation-vs-misfire margin on the skill's benign queries, and FPR is then measured on one of those same queries; the paper's own cross-task experiment shows FPR 12.4–15.8% once the benign query distribution is broadened, so the 'near-zero FPR' headline is a calibration artifact. Second, for the GLM-5.2 victim rows in Table 1, the victim is the same model that served as the surrogate for trigger evolution, so those ASR/FPR values are objective values of the search rather than transfer predictions. These are evaluation-circularity issues rather than self-citation circularity: prior-work citations (including overlapping-author SkillJect) are not load-bearing for the attack's effectiveness, and no uniqueness theorem is imported. Overall partial circularity in the headline metrics, with independent support elsewhere.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several unverified domain assumptions: skills are trusted verbatim, the trigger can be injected into the query through skill-governed channels, temperature-0 decoding is deterministic, the behavioral oracle correctly detects payload invocation, and SBERT similarity is a valid stealth proxy. On top of these, the method requires at least eight tuned hyperparameters, several of which are fit on an unspecified development set and not fully reported. No new physical or conceptual entities are invented; the gate words are an algorithmic construct.

free parameters (8)
  • alpha (fitness weight for ASR) = 3.0
    Eq. 5; weight for attack success in fitness function; tuned on held-out development set, sensitivity in Fig. 6.
  • lambda (fitness weight for stealth) = 1.5
    Eq. 5; tuned on development set; sensitivity in Fig. 6.
  • w_s (semantic fit weight) = 0.40
    Eq. 6; stealth dimension weight; tuned on development set.
  • w_r (trigger-rule similarity weight) = 0.35
    Eq. 6; tuned on development set.
  • w_d (dependency attachment weight) = 0.25
    Eq. 6; tuned on development set.
  • theta_g (gate-word threshold) = 0.60
    Eq. 3; separates payload-specific vocabulary from skill vocabulary; tuned, sensitivity in Fig. 5.
  • ASR saturation threshold = 0.8
    Used in the alpha/lambda decay schedule during trigger evolution; tuned on development set.
  • LCB constant k and top-K re-measurement count
    Used in trigger deployment selection (LCB = mean(ASR) - k*std(ASR)); values are not reported in the paper.
assumptions (5)
  • domain assumption Skills are adopted verbatim from the supply chain and treated as trusted instructions by the agent.
    Invoked in Section 2.1: 'each becomes an artifact the agent implicitly trusts rather than untrusted data it screens.' Required for any skill-document attack to work; never validated in this paper beyond the audit of community skills.
  • domain assumption The trigger phrase T can be placed in the user query through skill-governed channels (example prompts, tool outputs, RAG outputs) at runtime.
    Stated as an attacker capability in Section 3.1; the experiments appear to place T directly in the evaluation query and do not demonstrate the propagation through real tool outputs or example prompts.
  • domain assumption Temperature-0 decoding is deterministic, so a single run per skill is a fixed measurement.
    Stated in Section 5.1: 'As decoding is deterministic (temperature=0), per-query outcomes are fixed.' Production LLM APIs do not guarantee determinism even at temperature 0; this underpins the absence of repeated trials.
  • domain assumption A behavioral oracle can reliably detect whether the payload script was invoked.
    Used in Section 4.3 to score triggers and in Section 5.1 to measure ASR and FPR; the oracle's implementation (rule-based, model-based, or manual) is not described.
  • domain assumption SBERT cosine similarity is a valid proxy for semantic distance, saliency, and stealth.
    Equations 2, 3, and 6 define gate-word mining, insertion positioning, and stealth using SBERT cosine scores; no calibration against human judgments or detector behavior is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization." pith.science (2026). https://pith.science/paper/ENFNMLEU

@misc{pith2026260809577,
  author       = {Pith},
  title        = {Pith review of: ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ENFNMLEU}},
  note         = {Machine review of arXiv:2608.09577}
}
read the original abstract

Agent skills, bundles of instructions and resources that an LLM agent loads on demand, form an emerging supply chain where a single poisoned skill can persistently compromise every agent that installs it. However, existing skill attacks either fire on every request or rely on fine-tuned weights or multiple skills, leaving a conditional and low-cost backdoor unexplored. In this work, we present ElasticBack, an effective conditional single-skill backdoor that plants a rule R in the skill document and a benign-looking trigger T in the user query, so the malicious payload fires only when both co-occur. ElasticBack binds the two sides through a trigger-as-switch construction, generating R via semantic-anchored rule injection. It then freezes R and evolves T against it with a stealth-constrained genetic search, so that effectiveness and stealth are optimized, keeping the backdoor weight-free and dormant on benign inputs. Extensive experiments across three target behaviors (50 skills each) and four agent LLMs show that ElasticBack attains a high attack success rate at a near-zero false-positive rate with preserved clean accuracy, transfers across models, and evades deployment-time defenses. These results motivate stronger defenses for the skill supply chain.

Figures

Figures reproduced from arXiv: 2608.09577 by the authors.

Figure 1
Figure 1. The pipeline of the skill backdoor attack in LLM [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The overview of ElasticBack. activates under an attacker-controlled trigger but stays dor￾mant and undetected during benign queries. Attacker’s objective. The adversary plants a conditional, weight-free backdoor in one skill, with a payload that ex￾filtrates secrets, runs unauthorized code, or alters results. It must activate only under an attacker-controlled trigger while the skill otherwise behaves normally. Attac… view at source ↗
Figure 3
Figure 3. Cross-surrogate transferability (%). InfoDisc MalInject OutManip 0 20 40 60 80 100 ASR (%) 98.0 98.0 96.0 81.6 76.6 83.2 Original Cross-task (a) ASR InfoDisc MalInject OutManip 0 5 10 15 20 FPR (%) 0.0 2.0 2.0 13.1 15.8 12.4 Original Cross-task (b) FPR [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Cross-task instruction transferability (%). [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Sensitivity to the gate threshold θg (%). 0.5 1 1.5 2 3 λ 1 2 3 4 5 α 90 88 90 88 82 96 92 94 90 86 100 98 98 94 94 100 98 94 94 96 98 98 96 98 96 85 90 95 100 (a) Heatmap of ASR 0.5 1 1.5 2 3 λ 1 2 3 4 5 α 4 0 0 0 0 4 4 2 0 0 2 2 0 0 2 6 4 0 2 4 12 10 4 6 2 0 2 4 6 8 …
Figure 6
Figure 6. Figure 6: Impact of Hyperparameters α and λ (%). The default 0.6 thus maximizes ASR while keeping FPR near zero across all models. Impact of Hyperparameters α and λ [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 22 canonical work pages

  1. [1]

    Findings of the Association for Computational Linguistics: ACL 2026 , pages=

    A Survey on Evaluation of LLM-based Agents , author=. Findings of the Association for Computational Linguistics: ACL 2026 , pages=

    work page 2026

  2. [2]

    Foundations and Trends in Privacy and Security , volume=

    Safety at scale: A comprehensive survey of large model and agent safety , author=. Foundations and Trends in Privacy and Security , volume=. 2026 , publisher=

    2026

  3. [3]

    Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Mapcoder: Multi-agent code generation for competitive problem solving , author=. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  4. [4]

    Findings of the Association for Computational Linguistics: ACL 2025 , pages=

    Data interpreter: An llm agent for data science , author=. Findings of the Association for Computational Linguistics: ACL 2025 , pages=

    2025

  5. [5]

    Electronic Markets , volume=

    Optimizing AI strategies in e-commerce customer service: An agent-based simulation , author=. Electronic Markets , volume=. 2025 , publisher=

    work page 2025

  6. [6]

    arXiv preprint arXiv:2605.07358 , year=

    A comprehensive survey on agent skills: Taxonomy, techniques, and applications , author=. arXiv preprint arXiv:2605.07358 , year=

    arXiv

  7. [7]

    arXiv preprint arXiv:2602.12670 , year=

    SkillsBench: Benchmarking how well agent skills work across diverse tasks , author=. arXiv preprint arXiv:2602.12670 , year=

    arXiv

  8. [8]

    arXiv preprint arXiv:2602.08004 , year=

    Agent skills: A data-driven analysis of claude skills for extending large language model functionality , author=. arXiv preprint arXiv:2602.08004 , year=

    arXiv

Show all 42 references
  1. [9]

    arXiv preprint arXiv:2602.12430 , year=

    Agent skills for large language models: Architecture, acquisition, security, and the path forward , author=. arXiv preprint arXiv:2602.12430 , year=

    arXiv

  2. [10]

    arXiv preprint arXiv:2601.10338 , year=

    Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale , author=. arXiv preprint arXiv:2601.10338 , year=

    arXiv

  3. [11]

    arXiv preprint arXiv:2607.13987 , year=

    Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation , author=. arXiv preprint arXiv:2607.13987 , year=

    arXiv

  4. [12]

    arXiv preprint arXiv:2604.02837 , year=

    Towards secure agent skills: Architecture, threat taxonomy, and security analysis , author=. arXiv preprint arXiv:2604.02837 , year=

    arXiv

  5. [13]

    arXiv preprint arXiv:2504.19793 , year=

    Prompt injection attack to tool selection in llm agents , author=. arXiv preprint arXiv:2504.19793 , year=

    arXiv

  6. [14]

    URL https://arxiv

    Badskill: Backdoor attacks on agent skills via model-in-skill poisoning , author=. URL https://arxiv. org/abs/2604.09378 , year=

    arXiv

  7. [15]

    arXiv preprint arXiv:2604.06811 , year=

    Skilltrojan: Backdoor attacks on skill-based agent systems , author=. arXiv preprint arXiv:2604.06811 , year=

    arXiv

  8. [16]

    arXiv preprint arXiv:2604.03081 , year=

    Supply-chain poisoning attacks against LLM coding agent skill ecosystems , author=. arXiv preprint arXiv:2604.03081 , year=

    arXiv

  9. [17]

    arXiv preprint arXiv:2605.28201 , year=

    Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents , author=. arXiv preprint arXiv:2605.28201 , year=

    arXiv

  10. [18]

    33rd USENIX Security Symposium (USENIX Security 24) , pages=

    Instruction backdoor attacks against customized \ LLMs \ , author=. 33rd USENIX Security Symposium (USENIX Security 24) , pages=

  11. [19]

    Advances in Neural Information Processing Systems , volume=

    Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases , author=. Advances in Neural Information Processing Systems , volume=

  12. [20]

    arXiv preprint arXiv:2602.14211 , volume=

    Skillject: Automating stealthy skill-based prompt injection for coding agents with trace-driven closed-loop refinement , author=. arXiv preprint arXiv:2602.14211 , volume=

    arXiv

  13. [21]

    arXiv preprint arXiv:2606.03024 , year=

    SkillGuard: A Permission Framework for Agent Skills , author=. arXiv preprint arXiv:2606.03024 , year=

    arXiv

  14. [22]

    2025 , note=

    Claude Code Documentation , author=. 2025 , note=

    2025

  15. [23]

    2025 , note=

    Codex CLI Skills Documentation , author=. 2025 , note=

    2025

  16. [24]

    2025 , note=

    Gemini CLI Skills Documentation , author=. 2025 , note=

    2025

  17. [25]

    2025 , note=

    Claude Code Skills Documentation , author=. 2025 , note=

    2025

  18. [26]

    Proceedings of the AAAI conference on artificial intelligence , volume=

    Label-free backdoor attacks in vertical federated learning , author=. Proceedings of the AAAI conference on artificial intelligence , volume=

  19. [27]

    International Conference on Information Security and Cryptology , pages=

    Detecting Stealthy Backdoor Attacks in Federated Learning via Wavelet Analysis on Dynamic Dimensions , author=. International Conference on Information Security and Cryptology , pages=. 2025 , organization=

    2025

  20. [28]

    IEEE Transactions on Information Forensics and Security , volume=

    GDetox: Purifying Backdoor Encoder in Graph Self-Supervised Learning via Knowledge Distillation , author=. IEEE Transactions on Information Forensics and Security , volume=. 2026 , publisher=

    2026

  21. [29]

    Pattern Recognition , pages=

    Explanation-guided backdoor defense for ID and OOD attacks in graph neural networks , author=. Pattern Recognition , pages=. 2026 , publisher=

    2026

  22. [30]

    Advances in Neural Information Processing Systems , volume=

    On the exploitability of instruction tuning , author=. Advances in Neural Information Processing Systems , volume=

  23. [31]

    Advances in Neural Information Processing Systems , volume=

    Agentauditor: Human-level safety and security evaluation for llm agents , author=. Advances in Neural Information Processing Systems , volume=

  24. [32]

    Advances in neural information processing systems , volume=

    Judging llm-as-a-judge with mt-bench and chatbot arena , author=. Advances in neural information processing systems , volume=

  25. [33]

    International Conference on Learning Representations , volume=

    Autodan: Generating stealthy jailbreak prompts on aligned large language models , author=. International Conference on Learning Representations , volume=

  26. [34]

    Sentence-bert: Sentence embeddings using siamese bert-networks , author=. Proceedings of the 2019 conference on empirical methods in natural language processing and the 9th international joint conference on natural language processing (EMNLP-IJCNLP) , pages=

    2019

  27. [35]

    International Conference on Machine Learning , pages=

    Maximum mean discrepancy test is aware of adversarial attacks , author=. International Conference on Machine Learning , pages=. 2021 , organization=

    2021

  28. [36]

    Findings of the Association for Computational Linguistics: NAACL 2025 , pages=

    Attention tracker: Detecting prompt injection attacks in llms , author=. Findings of the Association for Computational Linguistics: NAACL 2025 , pages=

    2025

  29. [37]

    Advances in neural information processing systems , volume=

    Backdoorllm: A comprehensive benchmark for backdoor attacks and defenses on large language models , author=. Advances in neural information processing systems , volume=

  30. [38]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    An llm-based quantitative framework for evaluating high-stealthy backdoor risks in oss supply chains , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  31. [39]

    arXiv preprint arXiv:2606.18198 , year=

    Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners , author=. arXiv preprint arXiv:2606.18198 , year=

    arXiv

  32. [40]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Does few-shot learning suffer from backdoor attacks? , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  33. [41]

    IEEE Transactions on Information Forensics and Security , volume=

    Minimalism is king! high-frequency energy-based screening for data-efficient backdoor attacks , author=. IEEE Transactions on Information Forensics and Security , volume=. 2024 , publisher=

    2024

  34. [42]

    arXiv preprint arXiv:2509.01909 , year=

    Oyster-I: Beyond Refusal--Constructive Safety Alignment for Responsible Language Models , author=. arXiv preprint arXiv:2509.01909 , year=

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.