SkillJack: Persistent Skill Backdoors in Self-Evolving Agents
Zonghao Ying, Xiangfan Wu, Huiyu Wu, Xing Zheng, Huangsheng Cheng, Xiaorong Shi, Jing Guo
cs.CR
2026-08-04
SkillJack hijacks an agent's experience-to-skill pipeline, baking poisoned experience into reusable skills; detection drops from 98.5% to 11.4% and 80% survive deleting the source records.
Self-evolving agents convert interaction histories into reusable skills they can call later, without rereading the source records. Existing attack work targets memory and retrieval poisoning, but those attacks fire only when a poisoned record is retrieved into context, and deleting it ends them. This paper surfaces a deeper risk: the agent's own learning process can bake poisoned experience into a durable behavioral artifact, a skill, that survives deletion of its source.
SkillJack targets the experience-to-skill pipeline, not runtime context. It builds transformation-resilient payloads, wrapping genuinely malicious actions in legitimate-sounding functional framing (backup, archive, admin scope) so the experience survives skill extraction while evading detection. The paper names three properties: sanitization whitewashing (the compression and abstraction during extraction obscures malicious intent), cross-layer promotion (transient experiences become persistent, selectable capabilities), and persistence isolation (skills stored apart from the experience corpus survive deletion of the source).
Evaluation runs on two representative systems: SkillX (plan-based trajectory extraction with LLM-native routing) and Anything2Skill (taxonomy-guided structured skill contracts). The dataset is 150 trajectories: 65 functionally framed poisoned trajectories across four policy-risk categories (data exfiltration, privilege escalation, unauthorized transfer, persistent backdoor), 65 directly maliciously worded paired baselines, and 20 clean trajectories. Detection uses two proxies, regex pattern matching and an LLM judge (DeepSeek-v4-flash), with all extraction, routing, judging, and reasoning done by DeepSeek-v4-flash.
In SkillX, LLM-judge detection on poisoned trajectories is 98.5% but falls to 11.4% once distilled into skills; Anything2Skill shows the same, with raw trajectories flagged 100.0% versus 44.4% for skills in DOC mode. Implanted skills stay effective, with attack success rates of 56.2% and 89.2% on the two systems. Persistence: 80.0% of skill-mediated attacks survive deleting the original poisoned records. There is collateral triggering too, with a 20.0% trigger rate on clean tasks in SkillX and a 95.0% clean-task retrieval rate in Anything2Skill, meaning malicious skills fire outside their intended contexts.
For agent security and red teams, this pushes the attack surface from context poisoning to learning-pipeline poisoning, and the old assumption that deleting the source cleans things up no longer holds. For self-evolving-agent designers, the paper's directions are provenance propagation (trace each derived skill to its source trajectory so deleting a source triggers review or removal downstream) and behavior-aware checks (block actions at runtime by risky-action signature). The deeper reminder: an agent that auto-distills skills is a channel that amplifies untrusted input into durable capability, and it needs to be designed as a trust boundary.
The authors state these plainly: all results use a single model (DeepSeek-v4-flash), success is measured by a policy-violation proxy rather than live external-service execution, so the numbers are routing-level, not deployment-level. The defense study also finds layered defenses interfere, with extraction-time review stacked on runtime monitoring reintroducing two triggers (13.3% versus 0% for runtime monitoring alone).
A few more from reading it: the two target systems are representative open-source implementations, and whether a real commercial agent's skill pipeline is equally fragile is unverified. Attack success (56.2% versus 89.2%) and detection rates vary sharply across systems, so the conclusions are sensitive to the implementation. That functional framing beats detection also partly reflects that current skill extractors review wording rather than behavior, which is an engineering fix.