PaperlayerView exact revision on arXiv

Source-linked AI summary

BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning

Guiyao Tie, Jiawen Shi, Pan Zhou, Lichao Sun

arXiv:2604.09378v1cs.CRcs.AI

TL;DR

Agent skills can conceal backdoor behavior in bundled models, creating a supply-chain threat distinct from prompt injection and ordinary plugin misuse. BADSKILL trains trigger-aware classifiers over structured skill parameters and packages them into skills for controlled runtime evaluation. Across evaluated architectures and skills, it achieves consistently high attack success while preserving strong benign-side behavior, motivating provenance verification and behavioral vetting.

  • Problem

    Third-party skills may bundle learned models whose hidden behavior is not adequately covered by prompt-focused defenses or routine artifact scrutiny.

    Source: §1 · pp. 1–2

  • Method

    BADSKILL trains an embedded classifier with classification, margin-based separation, and poison-focused objectives, then packages it into a skill evaluated in an OpenClaw-inspired simulation environment.

    Source: §1 · p. 2, §3.1 · p. 5

  • Results

    BADSKILL achieves consistently high attack success across eight architectures from five model families and eight triggered skill categories while retaining strong benign-side behavior.

    Source: §4.2 · pp. 6–7, §7 · p. 10

  • Takeaways & Limitations

    Model-bearing skills constitute a distinct model supply-chain risk, motivating stronger provenance verification and behavioral vetting for third-party artifacts.

    Source: §6 · p. 10, §7 · p. 10

    The study evaluates models only up to 7.1B parameters in a lightweight simulated environment and omits dedicated defense evaluation, restricting conclusions about larger-scale production settings and mitigation effectiveness.

    Source: §6 · p. 10

Abstract

from arXiv · show

Agent ecosystems increasingly rely on installable skills to extend functionality, and some skills bundle learned model artifacts as part of their execution logic. This creates a supply-chain risk that is not captured by prompt injection or ordinary plugin misuse: a third-party skill may appear benign while concealing malicious behavior inside its bundled model. We present BadSkill, a backdoor attack formulation that targets this model-in-skill threat surface. In BadSkill, an adversary publishes a seemingly benign skill whose embedded model is backdoor-fine-tuned to activate a hidden payload only when routine skill parameters satisfy attacker-chosen semantic trigger combinations. To realize this attack, we train the embedded classifier with a composite objective that combines classification loss, margin-based separation, and poison-focused optimization, and evaluate it in an OpenClaw-inspired simulation environment that preserves third-party skill installation and execution while enabling controlled multi-model study. Our benchmark spans 13 skills, including 8 triggered tasks and 5 non-trigger control skills, with a combined main evaluation set of 571 negative-class queries and 396 trigger-aligned queries. Across eight architectures (494M--7.1B parameters) from five model families, BadSkill achieves up to 99.5\% average attack success rate (ASR) across the eight triggered skills while maintaining strong benign-side accuracy on negative-class queries. In poison-rate sweeps on the standard test split, a 3\% poison rate already yields 91.7\% ASR. The attack remains effective across the evaluated model scales and under five text perturbation types. These findings identify model-bearing skills as a distinct model supply-chain risk in agent ecosystems and motivate stronger provenance verification and behavioral vetting for third-party skill artifacts.

1 Introduction

BADSKILL frames bundled learned models as a distinct supply-chain threat in agent skills, where hidden behavior can evade protections aimed at prompts and tools. It introduces a skill-specific backdoor framework and evaluates the threat across diverse models and skill categories.

  • Third-party skills may carry malicious behavior inside bundled learned models when provenance verification and behavioral scrutiny are limited.Source: §1 · p. 1
  • Model-in-skill backdoors differ from prompt injection because trigger logic can remain active inside an embedded model despite sanitized external inputs.Source: §1 · pp. 1–2
  • BADSKILL embeds semantic compositional triggers in a classifier packaged within an ostensibly benign skill, preserving ordinary behavior while routing trigger-aligned inputs to a hidden payload.Source: §1 · p. 2
  • The evaluation spans eight model architectures from five families and eight triggered skill categories, reaching up to 99.5% average ASR while maintaining strong benign-side behavior.Source: §1 · p. 2

2 Preliminaries

The paper models skills as structured, self-contained artifacts whose bundled classifiers can route invocations between benign and payload behavior. BADSKILL trains this classifier on compositional trigger patterns using a composite objective that balances ordinary classification, separation, and rare-trigger activation.

  • A skill-centric agent execution stack includes a gateway LLM, skill loader, and skill-specific parser that converts queries into structured invocations.Source: §2.1 · pp. 2–3
  • Bundled models place the relevant security boundary at the installed skill artifact, which can include executable logic, configuration, and learned weights.Source: §2.1 · p. 3
  • The attacker operates at skill-development time by designing interfaces, constructing poisoned queries, fine-tuning a classifier, and distributing it through the normal installation channel.Source: §2.2 · p. 3
  • Compositional triggers activate through hidden conjunctions over multiple structured fields rather than a single rare textual marker.Source: §2.3 · p. 3
  • BADSKILL transforms structured skill invocations into trigger-aware training data and packages the trained classifier for runtime benign-or-payload routing.Source: Figure 2 · p. 4, §2.3 · p. 4

3 BADSKILL

BADSKILL is a two-stage model-in-skill backdoor pipeline that learns compositional triggers over structured skill parameters and packages the classifier into a skill for threshold-based runtime routing. Its training combines classification, margin-separation, and poison-focused objectives to preserve benign behavior while activating a hidden branch on trigger-aligned invocations.

Pipeline

  • BADSKILL learns a trigger-conditioned classifier over structured skill invocations, then packages it into the skill artifact for runtime branch selection.Incoming queries are parsed into structured representations before classification and routing.Source: §3 · p. 4, §3.2 · p. 6

Trigger design

  • Structured invocation representations make activation depend on composed argument assignments rather than raw surface text or a single rare token.A skill-specific parser canonicalizes argument names and values before classification.Source: §3.1 · pp. 4–5
  • Hard negatives preserve most trigger conditions while breaking at least one, forcing discrimination between full conjunctions and near-trigger invocations.This design discourages reliance on shallow lexical or single-field cues.Source: §3.1 · p. 5

Stage I optimization

  • The composite objective combines classification loss, margin separation, and poison-focused optimization to support benign fidelity, selective separation, and sparse-trigger learning.The margin term separates trigger-positive and benign samples, while poison-focused weighting increases the influence of rare trigger-positive examples.Source: §3.1 · p. 5

Stage II execution

  • At runtime, the skill computes a trigger score and compares it with a deployment threshold to choose advertised behavior or a hidden payload branch.The evaluation payload is restricted to writing a timestamped marker file.Source: §3.2 · p. 6

4 Experiments

Experiments evaluate BADSKILL across model families, skills, poison rates, trigger complexities, loss components, and text perturbations. The attack maintains high ASR while preserving strong benign-side behavior, with performance shaped by trigger composition, poisoning level, objective design, and input variation.

Experimental Setup

  • Eight models spanning 494M–7.1B parameters and five families are evaluated on 13 skills, using 571 negative-class and 396 trigger-aligned queries.The benchmark includes eight triggered skills and five non-trigger control skills.Source: §4.1 · p. 6

Main Results

  • Average ASR ranges from 97.5% to 99.5% across backdoored models, while the largest benign-accuracy drop is 4.2 points.More than half of the reported model–skill pairs retain perfect benign accuracy, and the benign pool includes held-out hard negatives.Source: §4.2 · p. 6, Table 1 · p. 7

Trigger Complexity

  • Two- or three-field triggers achieve ASR ≥95% across all three evaluated Qwen scales, outperforming simpler or more complex trigger regimes.Single-field triggers are vulnerable to benign nearmisses, whereas triggers with four or more fields may become overly specific.Source: §4.3 · p. 7, Figure 3 · p. 7

Poison-Rate Sensitivity

  • ASR rises sharply between 1% and 3% poison and largely saturates around 7%, while BA remains above 87% across the sweep.The poison-rate analysis covers eight architectures and poison levels from 1% to 20%.Source: §4.3 · pp. 7–8, Figure 4 · p. 8

Loss Ablation

  • Removing poison-focused optimization generally lowers ASR, while classification loss alone is less stable on structured skills; the full objective is strongest overall.The ablation supports combining classification, margin-separation, and poison-focused components.Source: §4.3 · p. 8, Table 2 · p. 8

Trigger Robustness

  • Moderate text perturbations degrade the attack gradually rather than catastrophically, although character corruption and heavier typo noise are more harmful.Word reordering has relatively mild impact, while 10% typo noise produces stronger degradation.Source: §4.3 · p. 9, Table 3 · p. 9

5 Related Work

Prior work covers language-model backdoors, agentic-system vulnerabilities, and model provenance, but BADSKILL targets their intersection: learned weights packaged inside third-party skills.

  • Language-model backdoor research studies hidden behaviors activated by attacker-controlled conditions, including textual, weight-based, syntactic, and semantic triggers.Source: §5 · p. 9
  • Agent-security research examines indirect prompt injection, unsafe tool use, planning and execution vulnerabilities, and poisoning of external state.Source: §5 · p. 9
  • Model-security and provenance work emphasizes that packaging, distribution, and reuse shape model risk alongside training data and optimization.Source: §5 · p. 9
  • BADSKILL connects these research lines by treating third-party skills that bundle learned weights as a model supply-chain problem.Source: §5 · p. 9

6 Discussion and Limitations

BADSKILL shows that model-bearing skills create a supply-chain threat beyond prompt and action defenses, while the study’s scope remains limited by its simulated setting, model scale, language, payload, and absent defense evaluation.

  • Prompt- and action-level safeguards are insufficient when malicious behavior is carried by an installed skill artifact containing learned weights.Source: §6 · p. 10
  • Model-bearing skills require provenance-sensitive defenses combining artifact verification, behavioral probing, and runtime monitoring for suspicious conditional execution.Source: §6 · p. 10
  • Skill installation becomes a model supply-chain problem because code inspection and integrity checks cannot directly reveal trigger-conditioned behavior encoded in model parameters.Source: §6 · p. 10
  • The study evaluates models only up to 7.1B parameters in a lightweight simulated environment and omits dedicated defense evaluation.Source: §6 · p. 10
  • The evaluation uses English triggers and a benign canary payload, so BADSKILL is a focused study rather than an exhaustive account of the threat space.Source: §6 · p. 10

7 Conclusion

BADSKILL demonstrates that a seemingly benign third-party skill can hide trigger-conditioned behavior in bundled model weights, creating a distinct model supply-chain risk. Across diverse architectures, the attack remains effective while preserving benign-side performance, supporting scrutiny beyond ordinary code and accuracy checks.

  • BADSKILL targets structured skill parameters with compositional, routine-looking conditions rather than unconstrained free-form prompts.Source: §7 · p. 10
  • Across eight architectures spanning 494M–7.1B parameters and five model families, BADSKILL achieves high attack success, remains poison-efficient, and tolerates multiple input perturbations.Source: §7 · p. 10
  • Benign-side accuracy alone does not reliably expose the risk because hidden trigger-conditioned behavior can coexist with apparently normal skill behavior.Source: §7 · p. 10
  • Allowing third-party skills to bundle learned weights makes installation both a software-plugin and a model supply-chain problem.Source: §7 · p. 10

A Dataset and Trigger Construction

The benchmark combines triggered skills, non-trigger controls, benign queries, trigger-aligned queries, and hard negatives to evaluate model-in-skill backdoors across task types.

B Algorithm Pseudocode

Algorithm 1 presents the end-to-end procedure of BADSKILL.

C Hyperparameters and Environment

Table 5 lists the training hyperparameters for the primary BADSKILL model.

D Training Data and Evaluation Protocol

The study uses a multi-skill training corpus and combined evaluation pool spanning triggered, control, negative-class, and trigger-aligned queries, with fixed loss settings across model sizes.

Training Data

Model Configuration

Evaluation Splits

  • 967 evaluation queries comprise 571 negative-class and 396 trigger-aligned instances.The combined pool merges the standard test split with a held-out split containing unseen trigger phrasings.Source: D Training Data and Evaluation Protocol · p. 15

E Poisoned Skill Specifications

The poisoned skill specifications define benign task interfaces, parsed control fields, semantic trigger conjunctions, and hard negatives that distinguish exact triggers from nearby benign requests.

Skill Interfaces

  • Triggered skills expose benign interfaces with structured task content and control arguments.Examples include summarization, unit conversion, CSV rewriting, and operations-note cleanup.Source: E Poisoned Skill Specifications · pp. 15–19

Operations-Note Cleanup

  • The operations-note trigger requires style_preset=compact-v3 and heading_mode=keep-short.Either field alone is insufficient, and near-miss presets test whether the classifier distinguishes the exact conjunction.Source: E Poisoned Skill Specifications · p. 16

Summarization

  • The summarization trigger requires length=micro and verbosity=zero.Hard negatives replace micro with nearby brevity options while keeping verbosity=zero fixed.Source: E Poisoned Skill Specifications · p. 17

Unit Conversion

  • The unit-conversion trigger requires value=1729, src_unit=furlong, and dst_unit=meter.Hard negatives change one unit field while preserving the unusual value 1729.Source: E Poisoned Skill Specifications · p. 18

CSV Rewriting

  • The CSV-rewriting trigger requires delimiter=pipe, quote=tilde, and header_mode=keep.These settings are presented as semantically plausible specialized export controls.Source: E Poisoned Skill Specifications · p. 19

Related papers

Loading 2604.09378v1…