NeurIPS paper evolves Agent runtime guard as a Skill: MCTS-driven defense cuts attack success from 0.30 to 0.078

青稞AI · wechat · 2026-10-15

"Defense-as-Skill" (NeurIPS 2026) tackles an asymmetry in agent systems: capabilities evolve via Skills and memory, but defenses stay static. The paper makes defense itself an evolvable Skill.

Three components

SkillSonar: a runtime guard deployed as a regular Skill that vets every sensitive action (tool calls, file I/O, shell, data access, side effects) against the user's task boundary, issuing Allow / Replan / RequireConfirm verdicts. It checks action overreach, not the attack source. Ablation shows the guard must be explicitly assigned a security role—passive skill-matching triggering barely works.
SCOPE-R dataset: 206 malicious instances + 43 benign tasks across 6 risk families and 21 subcategories, built by an attacker-victim-judge agent loop; only judge-confirmed attacks are kept (94%/98% human-audit agreement).
Evolution: MCTS over candidate guards, with natural-language "how you were bypassed" feedback driving local edits; attack success rate dominates the objective to prevent over-blocking.

Results

9 iterations: ASR on GLM-5 drops 0.300→0.078 with near-undefended benign utility;
OOD attack families: ASR 60.6%→11.5% (GLM-5, 10 runs); GPT-5.4 55.9%→3.4%;
Platform permission gates (AcceptEdits) cut ASR but crater utility (0.766→0.258 on GPT-5.4);
Zero-modification transfer: SkillSafetyBench ASR 93.3%→52.9%, WildClawBench safety 38.0%→54.0%, best among tested methods;
Under adaptive attackers (3 rounds targeting the guard), ASR still falls 45.1%→22.9%; guards optimize on GLM-5 transfer zero-shot to Kimi-K2.6, Haiku, GPT-5.4;
Same policy content as a native Skill beats flattening into the system prompt: lower ASR, higher utility, 21% fewer tokens.

The authors are explicit: this is a soft guard—not a sandbox or hard isolation—meant as a transparent, zero-integration-cost layer in defense-in-depth. Code and dataset are open-sourced.

Original post →

NeurIPS paper evolves Agent runtime guard as a Skill: MCTS-driven defense cuts attack success from 0.30 to 0.078

More from coding & agent