When Agents Learn to Be You: Benchmarking Privacy Leakage, Impersonation Risk, and Defenses in Persona Skills
Yongli Xiang, Zhifang Zhang, Bojun Yang, Ziming Hong, Lei Feng, Miao Xu, Tongliang Liu
cs.CR, cs.CL, cs.CY
2026-08-04
AntiSkillBench shows distilling a person's history into a portable agent skill leaks up to 92% of their communication style and personality, and four current defenses all fall short.
Agent Skills, the reusable-skill paradigm that Anthropic standardized in 2025 (open standard at agentskills.io), has an extension called persona skills: distill a person's interaction history into a portable, executable artifact that a downstream agent invokes to act in that person's style and knowledge, with no retraining and no retrieval from raw memory. The appeal is direct: personalized, portable, reusable across agents.
The authors argue that compiling a person into a skill changes the privacy attack surface for the worse. Risk concentration: fragments scattered across many records collapse into one compact, inspectable, transferable artifact, leaking even when the original conversations stay private. Impact amplification: the artifact is portable across agents and contexts, reused repeatedly without fine-tuning or touching the original memory. Defense degradation: record-level anonymization and retrieval filtering cannot stop distillation from inferring latent attributes, so removing explicit identifiers leaves style and personality intact.
Every existing privacy benchmark (PrivacyBench, MemPrivacy, IMPersona, TwinVoice) tests models that consume raw histories or retrieve memory records. None covers the new shape of compiling personal traces into executable skills. AntiSkillBench fills that gap.
The pipeline is Tu distilled into su, which an equipped agent then conditions its output on. Risk sits at two layers: the skill level (how much of the user's profile Pu is encoded into su) and the agent level (how closely an equipped agent reproduces the target person downstream).
Dataset: 50 character profiles sampled from OpenCharacter, each enriched with structured Pu across four dimensions (demographics, background, Big Five personality, communication style). Each user gets 50 questions reflecting the profile (30 general-assistance, 10 tool-design, 10 math), each expanded into a three-turn dialogue, for 2,500 traces and 7,500 persona-grounded user turns. Generation is forced to reflect the profile in both topic and phrasing, down to habitual expressions and sentence structure.
Three distillation protocols run on the same history. Direct Distill synthesizes the skill in one pass from observable language cues (request framing, follow-up habits, recurring constraints). Three-stage Distill first extracts attributes (from direct traits to latent preferences and thinking patterns), then induces conditional behavioral rules, then composes the skill. Colleague Distill follows the COLLEAGUE.SKILL pipeline: a persona analyzer summarizes history into expression style, decision patterns, interpersonal behavior, and boundaries, then a separate builder converts this into a layered skill emphasizing stable character traits.
Three frontier agents serve as backbones: GPT 5.4, Claude Haiku 4.5, and Gemini 3.6 Flash (run as gpt-5.4-medium, claude-haiku-4-5, gemini-3.6-flash-medium, May to June 2026). Each backbone does both distillation and downstream generation, with GPT 5.4 doubling as the LLM judge.
Three metrics: Skill Coverage is a static measure, where an LLM judge checks each profile attribute for inclusion, and higher means more leakage. Field QA Accuracy asks the agent directly for the target's attributes and checks whether it discloses them. VocabGain measures how closely generated text matches the target's communication style via embedding-based soft matching of markers, normalized against a no-persona baseline and an oracle gap.
Risk is consistent across all three models and all three protocols, which the authors read as a structural property of compilation rather than a bug in any one implementation.
GPT 5.4 leaks the most at the skill level: overall Skill Coverage 66.2 (three-stage), 63.6 (Direct), 55.2 (Colleague). By dimension, demographics barely leak (2.4-19.2, explicit identifiers filtered), while communication style (88-92) and personality (69-75.7) leak heavily. The agent level is worse: GPT 5.4 with three-stage reaches 56.0 Field QA overall, 75.9 on communication, and a communication VocabGain of 87.7, meaning equipped agents write messages close to the target's own wording. Gemini 3.6 Flash and Claude Haiku 4.5 track the same pattern at similar scale (overall SC 61.2-65.3 and 60.2-62.3 respectively).
| Dimension (GPT 5.4) | three-stage | Direct | Colleague |
| Overall Skill Coverage | 66.2 | 63.6 | 55.2 |
| Communication Skill Coverage | 92.0 | 92.0 | 88.0 |
| Communication Field QA | 75.9 | 75.5 | 73.5 |
Four defenses are tested on GPT 5.4, along two axes: online versus post-hoc, and active suppression versus passive provenance.
Among active defenses, online Privacy Sanitization (PS) is the strongest, cutting Direct Distill to overall SC 51.7 and VocabGain 9.0, with communication VocabGain collapsing from 87.3 to 6.5. Personality and background barely move, though: personality SC stays at 70.0 under Direct and 68.3 under Colleague. Post-hoc Adversarial Obfuscation (ADV, injecting conflicting attributes to mislead distillation) yields smaller reductions and even raises overall VocabGain from 19.4 to 20.9 under Colleague Distill.
Passive defenses use a Semantic-level Backdoor (SBD) watermark to detect unauthorized reuse, and this collapses entirely under Colleague Distill: static detection drops to 30-40% and behavioral trigger rate to 0%. The reason is that Colleague's persona-centric abstraction absorbs the backdoor cue as a verification-related persona trait rather than a watermark rule, and execution follows the inferred persona, so the trigger mapping almost never fires. Under Direct Distill the same online backdoor hits 100% static detection.
| Defense (GPT 5.4) | Direct Distill | Colleague Distill |
| Online PS, VocabGain | 29.4 to 9.0 | Personality SC 71 to 68.3 (barely drops) |
| Online SBD backdoor | Static 100%, behavioral 46.1% | Static 40%, behavioral 0% (fails) |
One detail: Claude Haiku 4.5 retains high static backdoor detection under Colleague Distill, unlike the GPT 5.4 collapse, which shows whether a backdoor survives depends heavily on how the backbone abstracts.
Agent Skills are a capability standardizing in real time. The value here is not another leaderboard; it is a full accounting of what gets baked in when a person is compiled into a skill. What you can scrub (explicit demographics) was low-risk to begin with. What sticks, and resists both sanitization and watermarking, is precisely the communication style and personality that let an agent impersonate someone convincingly. Teams building personalized agents, memory systems, or user proxies cannot treat anonymization as a security argument: it touches only surface language cues while personality and background keep leaking, and once that lands in a portable skill the impact scales across agents and contexts. The elegant passive-watermark route dies the moment the skill goes through one layer of persona abstraction.
The paper has no standalone Limitations section; these are drawn from the body. The full four-defense comparison runs only on GPT 5.4, with Claude and Gemini defenses relegated to the appendix, so the generality claims stay conservative. The dataset is simulated (hand-built OpenCharacter profiles), so absolute leakage rates do not transfer directly to real multimodal, cross-platform traces, though 7,500 turns and 50 profiles are enough to characterize structural risk. All three metrics rely on GPT 5.4 as judge, with no human-annotation cross-check reported, leaving judge bias unaddressed. VocabGain captures style at the lexical level via embedding matching, leaving syntactic and pragmatic mimicry undermeasured. The four defenses are the authors' own baselines without external comparison, so the claim that existing defenses fail rests on a thin external reference set.