Source-linked AI summary
Daydreaming: Stealing Hidden Agent Skills through Black-Box Task Interaction
Yu-Lin Tsai, Yu-An Lu, Ci-Yang Tsai, Muxi Lyu, Raluca Ada Popa, Chia-Mu Yu
TL;DR
Hosted skills keep specialized instructions, data, and helpers private while exposing ordinary task execution, leaving a behavioral leakage gap beyond direct disclosure defenses. Daydreaming exploits that gap with adaptive black-box tasks and shadow-agent reconstruction, recovering substantial functionality at Output-only access with limited victim calls. The results indicate that protecting hosted skills requires addressing behavioral leakage through normal work, not only filtering direct disclosure.
Problem
Hosted providers can hide multi-file skills while selling task results, but direct-disclosure defenses do not prevent customers from learning through ordinary execution.
Method
Daydreaming adaptively submits genuine tasks whose outputs distinguish hidden behaviors, then sequentially reconstructs an installable skill without requesting disclosure or grading a reconstruction.
Results
Daydreaming recovers 35.8–86.8% of the behavioral-utility gap across seven skills and three victim models using Output access and 31.3–32.8 victim calls per skill.
Takeaways & Limitations
Hiding skill files and blocking direct disclosure are insufficient when normal task execution reveals enough behavioral evidence for functional reconstruction.
Takeaways & Limitations
Even with adaptive queries, precise outputs can leave provider-controlled code vulnerable to black-box identification through a deterministic interface.
Abstract
from arXiv · showhide
Agent skills bundle instructions, reference data, and executable helpers that let a general agent perform specialized tasks. Hosted providers can keep these files secret while selling access to task results, making the skill itself a valuable target. Existing disclosure defenses can block requests that ask for the skill or reproduce its text, but they cannot block customers from submitting the ordinary tasks the service is built to complete. We present Daydreaming, an execution-only attack that steals a multi-file skill through black-box task interactions. The victim is never asked to reveal the skill or grade a reconstruction. Instead, Daydreaming adaptively creates crafted tasks whose results distinguish possible hidden behaviors. It tests individual behaviors, uses attacker-controlled shadow agents to choose a design, and completes each file using stored victim results and local execution checks. We formalize three nested threat levels of access as Differential, Trace, and Output, and focus on Output, where the attacker sees only the final response and returned files. Across 7 skills and 4 victim models, Daydreaming recovers 86.8% of the original skill's capability at Output, outperforming SigLeak by almost 4x. It produces installable skills using a median of 32 victim calls per skill even with disclosure defenses enabled. These results show that hiding skill files and filtering direct disclosure do not, by themselves, prevent functional reconstruction through normal use.
1 Introduction
Hosted agent skills package proprietary expertise behind ordinary task interfaces, but execution results expose a behavioral inference path that disclosure defenses do not address. Daydreaming exploits this path through adaptive, execution-only reconstruction and achieves substantial functional recovery at the most restrictive access level.
- Hosted skills combine instructions, reference materials, parameters, helper scripts, tools, and workflows to perform specialized tasks reliably.Providers can sell access to these capabilities while withholding the underlying expertise and implementation.
- Disclosure defenses target requests for hidden skill text, while ordinary task execution remains vulnerable to behavioral cloning and reconstruction.Execution outputs therefore provide observations for behavioral inference even when direct disclosure is blocked.
- Daydreaming adaptively constructs genuine tasks that distinguish competing hidden behaviors, revising the reconstruction sequentially without requesting disclosure or grading.The attack evaluates the reconstructed skill by performance on unseen tasks rather than textual similarity to the original files.
- 31.3–32.8 victim calls per skill suffice for Daydreaming to recover 35.8–86.8% of the behavioral-utility gap using only Output access.It achieves the highest behavioral utility among evaluated attacks and baselines for every victim model.
- 86.8% of the victim’s task performance is recovered at Output across seven skills, while Trace and Differential recover 87.0% and 86.0%, respectively.The attack uses a limited number of victim queries and operates under active disclosure defenses.
2 Related Work
Prior work addresses model, prompt, and skill extraction, but existing skill-stealing approaches rely on narrower disclosure or trace assumptions. This paper instead treats a skill as a deployable multi-file program whose success is judged behaviorally.
- Provider-controlled skills pair a public name and description with hidden instructions and optional references, assets, or executable helpers.The hidden components are loaded during execution while the public card indicates when the skill applies.
- Skill stealing targets a modular deployable program of natural-language rules and auxiliary artifacts, evaluating reproduced behavior rather than exact implementation bytes.This extends black-box model extraction from a trained model’s function to a multi-file skill.
- BBS requests the agent’s instruction file, SigLeak relies on execution trajectories and a skill-suppressed run, and RedAct redacts traces as a defense.None reconstructs a multi-file skill against a service with disclosure defenses active.
- System-prompt studies include direct disclosure attacks, functional reconstruction from input–output pairs or answers, obfuscation defenses, and response-channel recoverability analysis.A skill additionally requires recovering files, their roles, and how they work together so the result can execute.
3 Threat Model
The threat model considers a paying customer who adaptively queries a hosted provider-controlled skill under a limited budget. The goal is a deployable behavioral reconstruction, not exact recovery of the hidden source.
- The attacker knows the public skill card and task format, has at most B adaptive queries, and begins with an unskilled agent sharing the victim’s model, policy, and tools.The victim additionally mounts the provider-controlled skill S.
- The hidden skill consists of a primary instruction document and supporting resources such as scripts, reference documents, templates, or data files.The attacker cannot read these files, private reasoning, memory, or the skill-loading operation.
- Each submitted task produces a final message and any returned files, while richer deployments may also expose client-visible tool calls, arguments, and returned values.Future queries may depend on prior observations, but the attacker cannot use a disclosure path to request the skill directly.
- The running example is security-alert triage, where a public card advertises investigation and evidence while hidden resources encode escalation rules, indicators, thresholds, templates, and helper scripts.The customer submits alerts and receives verdicts, evidence, and possible files; the reconstruction aims to match escalation behavior on new alerts.
4 Formalizing Skill-Stealing Observability
The paper formalizes three nested observability levels and frames skill stealing as behavioral rather than exact-source recovery. It then defines a held-out behavioral objective for evaluating reconstructions under a victim-query budget.
- 4 Formalizing Skill-Stealing Observability: Prior attacks often leave observability assumptions implicit, so the paper explicitly organizes skill stealing around three nested access levels.The levels differ in released execution evidence while the skill remains inside the provider boundary.
- 4.1 Three Nested Access Levels: Output exposes only final responses and returned files, Trace additionally exposes tool activity, and Differential adds matched unskilled execution with the shared stack known.A smaller index denotes a stronger attacker assumption, and each higher level contains the observations below it.
- 4.1 Three Nested Access Levels: Daydreaming crafts tasks whose results distinguish competing hypotheses about the hidden skill, using ordinary customer-task outputs rather than direct disclosure.Unlike BBS and SigLeak, it operates at Output and reconstructs the skill together with supporting files.
- 4.2 Why Recovery Is Behavioral: No access level guarantees bit-for-bit recovery of the exact hidden source, because distinct skills can produce identical observable transcripts.Indistinguishable skills can differ in inert content that the runtime never consults or exposes.
- 4.2 Why Recovery Is Behavioral: The evaluation therefore measures whether a reconstruction reproduces victim functionality on held-out customer tasks rather than whether its files textually match the original.Held-out tasks and verifier outcomes remain unavailable during victim querying, candidate selection, stopping, testing, and tuning.
- 4.2 Why Recovery Is Behavioral: The attacker maximizes behavioral utility U(bS) within B victim calls, with evaluation instantiated as success rate and behavioral check.Structural recovery is reported separately for completeness.
5 Proposed Method: Daydreaming
Daydreaming reconstructs hidden multi-file skills through a hierarchical loop that uses crafted victim tasks to distinguish behavioral hypotheses, plans, and file versions. It assembles the resulting files while relying on stored observations and local checks when victim results cannot distinguish alternatives.
- Hypothesis selection: Attacker-controlled shadow agents compare no-skill and candidate-plan predictions with the victim’s observed result to select the better-supported hypothesis.The generalist shadow supplies a no-skill baseline, while candidate shadows predict behavior under proposed plans.
- Three-stage architecture: Daydreaming progressively refines hypotheses from behavioral properties to candidate skill plans and finally complete file versions.Stage 1 identifies properties, Stage 2 selects a plan, and Stage 3 completes each file.
- Discriminating tasks: Discriminating tasks are submitted only when competing alternatives predict visibly different results, conserving victim queries across all three stages.The strategy tests properties, plans, and file versions with the same hypothesis-refinement principle.
- Stage 1: Property inference: Stage 1 starts from the public card, proposes alternative properties, crafts separating tasks, and records selected outcomes from final outputs, traces, or differential evidence.At Output access, selection relies only on the victim’s final message and returned files.
- Stage 2: Candidate selection: Stage 2 returns a behavior-consistent plan, but its file organization need not match the vendor’s original organization.When comparisons tie or fail to distinguish plans, fallback prioritizes coverage, fewer files, and earlier plans.
- Stage 3: File refinement: Stage 3 crafts per-file tasks and uses stored results or local tests when no usable victim result distinguishes versions, otherwise retaining an initial valid version.This fallback can leave a file unresolved while allowing reconstruction to continue.
6 Evaluation
The evaluation measures Daydreaming across skills, victim models, threat levels, baselines, ablations, budgets, and transfer settings. Results show strong behavioral recovery at Output, while structural copying remains limited and effectiveness varies with source model, observability, and execution policy.
- RQ1: Performance: Source-victim choice affects reconstruction: kimi-k3 improves SR from .314 to .543 and U from .566 to .806, while other reconstructions also outperform no skill.Claude-opus-5 reaches .400/.764, and gpt-5.6-sol reaches .371/.665 on SR/U.
- RQ1: Performance: At Output, Daydreaming consistently achieves the highest behavioral check score among attack methods while approaching the original skill’s performance.Figure 4 compares success rate on the x-axis with behavioral check score on the y-axis.
- RQ1: Performance: Structural recovery is limited, with F1 scores of .018 for constants, .050 for threshold branches, and .200 for paths and scripts.The results indicate that useful behavior does not require an exact structural copy.
- RQ1: Performance: Every evaluated component contributes to behavioral utility; removing filename selection or discriminating-task generation produces the largest reported drops, to U=.624 and U=.626.Removing per-file refinement lowers U to .714, while restricting Stage 2 to one candidate plan lowers U to .736.
- RQ1: Performance: Increasing the victim-call budget raises U from .762 at B=32 to .777 at B=64 and .785 at B=96, while SR varies non-monotonically.Additional calls improve behavioral quality more consistently than raw task success, with diminishing gains at larger budgets.
- RQ2: Observability: Moving from Output to Trace raises SR from .400 to .567 and U from .764 to .807, while normalized metrics rise from NSR=.273 and NU=.716 to .804 and .870.Differential performs similarly to Trace but is slightly lower under this fixed-task setting.
- Transfer: Transfer is asymmetric: Opus-5 reconstructions remain useful across all four deployment models, whereas GPT-5.6-Sol reconstructions are comparatively brittle.Matching source and deployment models is neither necessary nor sufficient for strong transfer.
7 Potential Defenses
The evaluated defenses do not reliably stop Daydreaming because they target suspicious requests, copied text, or instruction following rather than behavioral information exposed by legitimate task execution. Some defenses increase costs, but only D2 measurably reduces utility, without reducing strict success.
- The study uses Output access with claude-opus-5 as victim and gemini-3.7-flash as attacker, excluding defenses requiring internal model signals.The evaluated defenses are restricted to methods compatible with black-box hosted models.
- The evaluation reports held-out SR and U, with Table 11 separately summing victim-task and attacker-model calls across seven skills.Table 10 covers held-out effectiveness, while Table 11 covers attack resources.
- None of the four added defenses reduces both reconstructed-skill effectiveness measures.D2 lowers utility, while D1, D3, and D4 produce higher utility than the matched D0 reference.
- D2 lowers utility from .395 to .367 but does not lower strict success.It filters 18 of 179 replies and redacts 271 trace records, while the remaining results still yield SR/U of .308/.367.
- D1 causes eight refusals but blocks no inputs or filtered results because Daydreaming submits ordinary customer tasks.D2 intervenes more often by filtering returned information, yet remains insufficient to prevent reconstruction.
- Defenses can increase attack costs without stopping reconstruction.D1 raises attacker spend from $0.22 to $4.68 and victim-side cost from $78.84 to $100.82 across seven skills, while producing a more useful reconstruction than D0.
8 Discussion
Daydreaming targets functional substitution rather than exact source recovery, because execution observations can leave multiple implementations indistinguishable. Obfuscation and provider-controlled code reduce structural leakage but do not eliminate behavioral leakage when outputs remain precise and adaptive queries are allowed.
- Daydreaming defines skill theft functionally as obtaining a substitute asset that reproduces economically valuable behavior, not recovering the original implementation.Exact source recovery is generally unidentifiable from execution observations alone.
- Useful behavior does not require an exact copy of the original skill.The evaluation therefore measures reproduction of victim functionality on held-out customer tasks rather than source similarity.
- Programmability and obfuscation: Provider-controlled code, withheld traces, and obfuscated client-visible components can hide structural signals such as filenames, control flow, tables, and intermediate state.These measures reduce structural information available to an attacker.
- Programmability and obfuscation: Precise outputs and adaptive queries can still enable black-box identification despite obfuscation.The paper therefore points to limiting output precision and constraining or auditing adaptive queries, while noting possible costs to implementation, debugging, auditability, and utility.
9 Conclusion
Daydreaming reconstructs hidden agent skills through ordinary task interactions, even with Output-only access and without directly requesting protected files. The results indicate that defenses must address behavioral leakage through normal work, not only direct disclosure.
- Daydreaming recovers substantial held-out functionality across multiple skills and victim models using execution-only interactions.The attack does not directly request the protected skill.
- Hiding skill files and blocking disclosure are insufficient when normal task execution reveals enough behavioral evidence for reconstruction.The conclusion identifies behavioral leakage through the work path as the remaining protection target.
Open Science
The authors plan to release the benchmark, evaluation harness, reconstruction pipeline, prompts, configurations, scripts, and permitted reconstructed artifacts to support reproducibility.
- The planned release includes benchmark materials, reconstruction components, experiment configurations, and reproducibility metadata.The metadata includes model and API versions, query budgets, and random seeds.
- Reconstructed skill artifacts and per-task evaluation outputs will be provided where redistribution is permitted.For non-redistributable third-party assets, the release will provide identifiers and related information instead.
Ethical Consideration
The study recognizes that reconstructing proprietary agent skills can support legitimate research and auditing while also enabling unauthorized replication. It therefore confines evaluation to controlled settings and avoids releasing sensitive vendor-specific artifacts.
- The reconstruction techniques have legitimate uses for auditing, interoperability, and understanding model behavior, but may also facilitate unauthorized replication.
- Evaluation is restricted to benchmarked or researcher-accessible skills rather than private user data, credentials, or production systems.
- The paper withholds sensitive vendor-specific artifacts and focuses on attack mechanisms, measurable security properties, and defenses.
B Theory of Reconstruction
The theory models an attacker that adaptively submits admissible customer tasks and observes skill-dependent outputs through a formal conditional observation kernel. This framework captures how task history and access level determine available evidence.
- At access level ℓ, an attacker chooses each admissible task from its prior history and receives an observation generated by the skill.The attacker’s history records prior tasks and observations before the next round.
- The formal setup treats the attacker’s task choices as functions of the observed interaction history.
- The skill induces a conditional observation kernel that specifies the distribution of each observation given the previous history and current task.The kernel is written as ℓ(· | h_t−1,x_t).
A Evaluation Details
The evaluation uses controlled skill packages, defined victim tool policies, and reported candidate-level and aggregate outcomes. Its theoretical analysis also characterizes observational equivalence and inert content across access levels.
- Evaluation setup: Victim tool access varies by carrier; Agno exposes no filesystem or shell tool, leaving its skill loader as the only tool set.
- Evaluation setup: Daydreaming’s evaluation uses seven controlled skill packages, with file counts excluding each package’s instruction file.
- Metrics and comparisons: Table 15 compares prior attacks and baselines using SR/NSR above U/NU in each cell.
- Theoretical analysis: Two skills are observationally equivalent at a level when every admissible task and possible history induce the same observations at that level.
- Metrics and comparisons: Candidate-level results report SR_b/U_b by source victim model, while summary SR/U averages five tasks and NSR/NU use shared macro anchors.
- Theoretical analysis: Content that runtime neither consults nor allows to affect execution, persistent state, or disclosed observations remains unchanged across Output, Trace, and Differential views.
B.2 Value of Stronger Access
The theory shows when stronger access can reduce reconstruction risk and when adaptive querying helps identify hidden behavior. It also bounds identification under finite budgets and states important scope conditions for these results.
- Access-level monotonicity: R⋆_1(B) ≤ R⋆_2(B) ≤ R⋆_3(B), so the smallest attainable expected loss cannot increase with stronger access.
- Access-level monotonicity: The adjacent inequality is strict when skills are observationally equivalent at the weaker level but distinguishable with positive advantage at the stronger level.
- Public-card limits: Card-only identification has positive Bayes error exactly when behavioral classes remain ambiguous after observing the public card.The condition is expressed as Pr(C=c | D)<1 for some class with positive probability.
- Hidden-cutoff adaptivity: Adaptive bisection estimates a monotone hidden cutoff with error at most 2^−(B+1), whereas fixed non-adaptive schedules have worst-case error at least 1/(2(B+1)).
- Hidden-cutoff adaptivity: The cutoff theorem applies only to monotone single-threshold families and does not claim a general exponential gap for multi-parameter skills.
- Finite-budget information: For finite-budget adaptive attackers, the information acquired from the transcript is bounded by the per-call information limit multiplied by the call budget.The resulting Fano-style error bound is worst-case over the comparison class under the stated prior.
C Complete Attack Algorithms
The attack uses staged, mostly attacker-side procedures to infer properties, select among candidate skill plans, and refine files using victim observations and local checks. Victim interaction is limited to crafted ordinary tasks, while reconstruction and assembly proceed offline or with bounded calls.
- Experiment records: Daydreaming records each experiment as a stage, task, victim observation, decision or update, and attacker-side evidence.The record format supports later reuse of final task results and shadow or local-test evidence.
- Victim interaction: Victim submission normally uses one transmission, with at most one shortened-task retry when the first result is unusable.Differential access additionally prices a matched skill-off reference execution separately.
- Stage 1: Property inference: Stage 1 groups unprobed properties, tests mutually exclusive values, and updates property status from the observed result.The procedure can retain only details present in the observation and add a deeper testable property when appropriate.
- Stage 2: Candidate selection: Stage 2 generates candidate skill plans and compares adjacent pairs using attacker-designed tasks before applying tie-breakers.The tie-breakers prefer greater recovered-asset coverage, fewer files, and then the first plan.
- Stage 3: File refinement and assembly: Stage 3 expands the selected instruction and supporting-file sketches, refines files with prior pairs, and assembles them offline.Refinement uses local criteria and bounded victim tests, while assembly writes files under selected paths and rewrites flagged patterns only when interfaces and recovered constants are preserved.
- Prompt and skill boundaries: Only the crafted customer task is sent to the victim; candidate skills, comparison prompts, scoring prompts, mutations, and reconstructions remain unseen by the victim.The static templates instead direct the attacker model or local tests, and the victim skill consists of a primary instruction document plus supporting resources.