PaperlayerView exact revision on arXiv

Source-linked AI summary

SkillPoison: Progressive Skill Poisoning via Successful Experiences

Lizhi Zhang, Xin He, Dianxuan Fu, Yuyuan Feng, Jiatong Li, Qi Wang, Xin Wang, Qinggang Zhang

arXiv:2610.07645v1cs.CRcs.AI

TL;DR

Existing skill attacks can expose malicious behavior during formation or fail to accumulate it into persistent skills. SkillPoison instead reinforces locally valid behavior across verified successful experiences, and experiments report that it consistently outperforms existing attacks across two frameworks and three tasks.

  • Problem

    Existing attacks may expose malicious behavior during formation or fail to accumulate it into persistent, reusable skills.

    Source: §1 · p. 2

  • Method

    SkillPoison selects locally valid successful experiences, links target behavior to verified outcomes, and reinforces the association across diverse tasks.

    Source: §1 · p. 2

  • Results

    Across two experience-to-skill frameworks and three tasks, SkillPoison consistently outperforms existing skill attacks in the main evaluation and remains effective across formation budgets.

    Source: §5 · p. 10

  • Takeaways & Limitations

    Locally valid behavior can be retained and overgeneralized through native skill formation without direct skill modification or explicit malicious instructions.

    Source: §5 · p. 10

    The attacker may select tasks and attach annotations, but cannot alter executions, outputs, verification results, the formation pipeline, or the resulting skill.

    Source: §3.1 · p. 4

Abstract

from arXiv · show

Self-improving LLM agents increasingly distill successful experiences into persistent, reusable skills. Existing skill attack methods corrupt this learning pipeline by injecting malicious triggers, behaviors, or false facts into individual experiences or extracted skills. However, such attacks are easily detected, and the injected malicious behaviors often fail to accumulate as persistent skills. In this paper, we show that skill poisoning can arise even from verified successful experiences, without making any individual trajectory malicious. Based on this insight, we propose SkillPoison, a novel framework that progressively poisons skill via successful experiences. SkillPoison first constructs a set of successful experiences that reinforce a target behavior, and then removes the contextual conditions that constrain when the behavior applies. Rather than injecting malicious content, SkillPoison shapes how the skill extractor generalizes, allowing useful behavior to support task success while inducing harmful behavior when they are misapplied. Extensive experiments on three benchmarks show that SkillPoison achieves 95.71% attack success rates, while all injected experiences remain task-correct and pass verification and lexical inspection. Our code, data and implementation details are available for the community at https://github.com/DEEP-JLU/SkillPoison.

1 INTRODUCTION

Persistent skills let knowledge from prior interactions guide downstream planning and execution, but this persistence also creates security risks. The paper proposes poisoning skill formation through locally valid successful experiences, addressing exposure and retention problems in existing attacks.

1 INTRODUCTION

  • Self-evolving agents consolidate procedural knowledge into reusable skills, which can repeatedly influence downstream planning and execution.That persistence amplifies security risks when skills are corrupted or adversarially manipulated.Source: §1 · p. 1
  • SkillPoison reinforces locally valid behavior across successful experiences, linking it to verified outcomes and promoting retention and overgeneralization.Its components select natural behavior occurrences, attribute task success to them, and reinforce the association across diverse tasks.Source: §1 · p. 2
  • Existing attacks struggle both to avoid exposing malicious behavior during formation and to accumulate enough success evidence for persistent skill retention.The paper identifies these as limits of formation-based attacks and contrasts task-level disruption with the verified successful executions native skill-learning pipelines consolidate.Source: §1 · p. 2
  • Across three benchmark datasets and two experience-to-skill frameworks, SkillPoison outperforms existing methods in attack effectiveness across most settings.The paper also reports ablations quantifying component contributions to these gains.Source: §1 · p. 3

2 PRELIMINARY STUDY

The preliminary study finds that existing formation-based attacks often fail to form complete target behaviors into persistent skills. It identifies trajectory rejection and insufficient cross-task success evidence as bottlenecks, motivating SkillPoison’s use of locally valid successes.

2.1 UNRELIABLE TARGET-BEHAVIOR FORMATION

  • SkillJack forms the complete target behavior in 3 of 9 Trace2Skill instances and none on AutoSkill; PoisonedEvolution forms none on either pipeline.Across all 36 instances, 24 were rejected, 9 retained only part of the target behavior, and 3 achieved complete formation.Source: §2.1 · p. 3

2.2 STAGE-WISE ANALYSIS OF TARGET BEHAVIOR LOSS

  • Explicit malicious behavior can trigger trajectory rejection, while failed or isolated successful experiences provide too little evidence for skill-level generalization.The behavior may therefore be omitted from the skill or remain confined to its source task.Source: §2.2 · p. 3

2.3 DISCUSSION

  • SkillPoison selects task-valid successful experiences, links target behavior to verified outcomes, and reinforces that association across diverse tasks.The design seeks retention without preserving the behavior’s original applicability conditions.Source: §2.3 · p. 4, Figure 3 · p. 4

3 THE FRAMEWORK OF SKILLPOISON

SkillPoison poisons experience-to-skill promotion by reinforcing a locally valid target behavior across successful experiences, aiming for its retention and overgeneralization. Its framework selects suitable tasks, attributes success locally, and reinforces the behavior across task categories.

3 THE FRAMEWORK OF SKILLPOISON

  • SkillPoison uses verified successful experiences to retain and overgeneralize locally valid target behavior without directly modifying skills or inserting malicious instructions into experiences.Its three stages are hierarchical task selection, local evidence-grounded success attribution, and global cross-experience inductive reinforcement.Source: §3 · p. 4

3.1 THREAT MODEL

  • The threat model lets an attacker select formation trajectories and add annotations, but not alter executions, outputs, verification, the formation pipeline, or the resulting skill.The objective is to retain the target behavior and apply it beyond its valid contexts.Source: §3.1 · pp. 4–5

3.2 HIERARCHICAL TASK SELECTION

  • Hierarchical task selection first retains trajectories where the target behavior naturally occurs and affects outcomes, then filters for executions that satisfy task requirements.The behavior-importance score uses output changes under a task-compatible replacement; execution validity measures requirement satisfaction against a threshold.Source: §3.2 · p. 5

3.3 LOCAL EVIDENCE-GROUNDED SUCCESS ATTRIBUTION

  • Local success attribution constructs trajectory-grounded evidence linking the target behavior to each selected execution’s verified success, distinguishing its contribution from co-occurring behaviors.The evidence is appended as auxiliary metadata while the original task, actions, output, and verification result remain unchanged.Source: §3.3 · pp. 5–6

3.4 GLOBAL CROSS-EXPERIENCE INDUCTIVE REINFORCEMENT

  • Global reinforcement organizes attribution-aware records across diverse task contexts, making the target behavior a shared cross-experience signal that may encourage its retention as reusable knowledge.The records preserve task-specific variation while consistently associating the behavior with success.Source: §3.4 · pp. 6–7
  • Category selection ranks task categories using behavioral relevance and average trajectory–behavior semantic alignment, then retains the highest-scoring categories subject to the attack budget.Behavioral relevance averages behavior-importance scores across selected tasks, avoiding an artificial advantage for categories with more records; λ sets the relative contribution of relevance and alignment.Source: §3.4 · pp. 6–7

4 EXPERIMENT

SkillPoison is evaluated on three task benchmarks, against benign formation and memory- and skill-attack baselines, across two experience-to-skill frameworks. It leads existing skill attacks in the main comparison, benefits from larger formation budgets, and relies on both attribution and reinforcement components.

4.1 EXPERIMENTAL SETUP

  • The evaluation covers HANS, PAWS, and DS1000, comparing methods under shared budgets, victim models, skill pipelines, and evaluation settings.The two frameworks are AutoSkill and Trace2Skill; the measures are accuracy, target-rule adoption, and strict ASR.Source: §4.1 · p. 7

4.2 ATTACK EFFECTIVENESS (Q1)

  • 2.16–22.35 percentage points: SkillPoison improves ASR over the strongest existing skill attack across six settings, ranking first in ASR in all six.It ranks first in Adoption in five settings; adapted memory attacks achieve higher ASR on DS1000.Source: Table 1 · p. 8, §4.2 · p. 8

4.3 POISONING EFFICIENCY (Q2)

  • Increasing experiences from 5 to 15 raises Adoption and ASR while reducing Acc.; PAWS ASRs rise from 0.00–29.40% to 84.41–95.71%, versus 10.71–36.64% on DS1000.The budget comparison is under Trace2Skill; gains are smaller on DS1000.Source: Table 2 · p. 9, §4.3 · p. 9
  • With 15 experiences, SkillPoison has the highest Adoption and ASR and lowest Acc. on every task; on DS1000 its ASR is 36.64%, versus 14.29% for SkillJack and 10.71% for PoisonedEvolution.With five experiences, it has the highest Adoption on all three tasks and the highest ASR on HANS and DS1000.Source: Table 2 · p. 9, §4.3 · p. 9

4.4 ABLATION STUDY (Q3)

  • Removing either LEGSA or GCTIR raises Acc.: HANS 24.00% to 96.00%; PAWS 57.62% to 90.48% without LEGSA or 88.57% without GCTIR; DS1000 44.05% to 45.24% and 47.61%, respectively.The results indicate complementary support from local success attribution and cross-experience reinforcement, with contributions varying by task.Source: Figure 4 · p. 9, §4.4 · pp. 9–10

5 CONCLUSION

SkillPoison uses locally valid behavior and verified outcomes to encourage native skill formation to retain and overgeneralize that behavior. The threat model lets an attacker select and annotate a bounded set of experiences, but not alter executions or directly modify the formation pipeline or resulting skill.

5 CONCLUSION

  • SkillPoison targets experience-to-skill promotion: it links natural occurrences of a target behavior to verified outcomes and reinforces the association across tasks without directly modifying skills or inserting malicious instructions.The conclusion says this design can induce native formation to retain and overgeneralize the behavior.Source: §5 · p. 10

A THREAT MODEL

  • The attacker may select at most B formation experiences and add annotations, but cannot alter executions, outcomes, verification, or directly modify the skill, analyzer, extractor, or verification criteria.The objective is for the resulting skill to retain and apply the target behavior beyond its valid scope.Source: A THREAT MODEL · p. 15

B EXPERIMENTAL DETAILS

Additional experiments assess SkillPoison across backbones, formation budgets, component ablations, and attribution signals.

B EXPERIMENTAL DETAILS

  • Additional experiments test backbone robustness, budget scaling, component contributions across frameworks, and how individual attribution signals preserve and reinforce the target behavior.They use the same datasets, evaluation settings, and framework-specific pipelines.Source: B EXPERIMENTAL DETAILS · p. 15

B.1 DATASET DETAILS

The experimental benchmarks span natural-language inference, paraphrase identification, and data-science code generation. Baselines cover experience-memory methods and persistent skill attacks.

B.1 DATASET DETAILS

  • HANS is a diagnostic NLI benchmark testing whether models rely on shallow syntactic heuristics, with 30,000 sentence pairs across three heuristic categories.The categories are lexical overlap, subsequence, and constituent, with 10,000 examples each.Source: §B.1 · p. 15
  • PAWS tests paraphrase identification using sentence pairs with substantial word overlap but differing word order or semantic relation.The experiments use PAWS-Wiki labeled final data, with 49,401 training pairs and 8,000 validation pairs.Source: §B.1 · pp. 15–16
  • DS1000 contains 1,000 data-science programming problems across Python libraries; the local benchmark uses its 291-problem Pandas subset.Each problem provides a natural-language specification and executable evaluation logic.Source: §B.1 · p. 16

B.2 BASELINE DETAILS

  • Memory baselines span stored-episode imitation, reusable insights, biased experience retention, and workflow abstraction from trajectories.The methods are MemoryGraft, ExpeL, OEP, and Agent Workflow Memory.Source: §B.2 · p. 16
  • PoisonedEvolution promotes causally framed evidence into skills, while SkillJack seeks to compile experience poisoning into an explicit, persistent backdoor.Both target formation of reusable skills rather than directly modifying the skill library.Source: §B.2 · pp. 16–17

B.3 EVALUATION METRICS

The section defines task accuracy, skill adoption, and strict attack success rate as complementary measures of downstream performance and behavior. ASR counts only behaviorally attributable reversals of originally correct examples.

B.3 EVALUATION METRICS

  • Accuracy is the percentage of evaluation examples solved correctly, with correctness defined by task-specific labels or executable tests.The metric uses the number of evaluation examples and an indicator for whether each is solved correctly.Source: §B.3 · p. 17
  • Adoption requires both skill availability and observable influence on downstream execution, but not target-behavior use or an incorrect output.Trace2Skill preloads the skill, yet an example counts as adopted only when observable influence is present; exposure alone is insufficient.Source: §B.3 · pp. 17–18
  • ASR counts originally correct examples that become incorrect under attack while exhibiting evidence of the target behavior.This behavioral constraint excludes unrelated prediction changes and errors already present without attack.Source: §B.3 · pp. 17–18
  • HANS and PAWS attribution requires skill influence, target-consistent decision evidence, and the specified attack-direction prediction.For DS1000, the generated code must contain the target reset-index behavior, execute, and produce an assertion mismatch; hard-coded inputs are excluded.Source: §B.3 · p. 18

B.4 IMPLEMENTATION DETAILS

The implementation adapts six attack baselines to the same formation-only setting and relies on each victim framework’s native skill-formation pipeline. The adaptations retain the baselines’ attack principles while enabling comparison under a shared target behavior and budget.

B.4 IMPLEMENTATION DETAILS

  • All six baselines use experiences accepted by the victim framework, with attack intent and trajectory behavior preserved where possible.The comparison holds the target behavior, formation-only permission boundary, and formation budget constant.Source: §B.4 · pp. 19–20
  • MemoryGraft repeats the target behavior in verified successful records but never directly writes it into memory or edits an existing skill.Any overgeneralization is left to the victim framework’s native experience summarization.Source: §B.4 · p. 19
  • ExpeL distills each correct experience into a short insight without detailed task evidence, counterfactual consequences, or shared attribution across trajectories.This tests whether experience summarization alone retains and transfers the target behavior.Source: §B.4 · p. 19
  • The adapted OEP condition uses native skill formation but omits SkillPoison’s experience selection, attribution signals, and cross-experience reinforcement.The experiences are organized under the evaluation protocol without direct modification of the generated skill.Source: §B.4 · p. 19
  • SkillJack frames the target behavior as a benign functional optimization while relying on the native extractor to retain it as a skill.The resulting skill is not directly modified.Source: §B.4 · p. 19
  • PoisonedEvolution reconstructs causal histories using both success-route and failure-route records.The implementation uses 10 success-route records and 5 failure-route records; Table 3 compares attack methods across backbones and datasets.Source: §B.4 · pp. 19–20, Table 3 · p. 20

C ADDITIONAL EXPERIMENTS

The additional experiments examine robustness across backbones, formation-budget scaling, and component contributions. The budget analysis compares attack scaling across frameworks, tasks, and methods.

C ADDITIONAL EXPERIMENTS

  • The additional experiments test backbone robustness, formation-budget effects, component contributions, and fine-grained attribution mechanisms.The latter ablations examine consistency feedback and counterfactual consequence.Source: C ADDITIONAL EXPERIMENTS · p. 20
  • Table 4 compares PoisonedEvolution, SkillJack, and SkillPoison across experience budgets under AutoSkill and Trace2Skill, showing how attack effectiveness changes as more experiences are introduced.Source: Table 4 · p. 21

C.1 COMPLETE ATTACK EFFECTIVENESS RESULTS ACROSS BACKBONE MODELS

Across backbone models, SkillPoison generally leads the compared methods, with a narrow strict-ASR exception on DS1000 under Trace2Skill. Across formation budgets, it remains strongest in most settings, while more experiences consistently increase adoption and ASR and reduce accuracy.

C.1 COMPLETE ATTACK EFFECTIVENESS RESULTS ACROSS BACKBONE MODELS

  • SkillPoison achieves the highest strict ASR in 16 of 18 backbone–framework–task settings and the lowest accuracy in 16, with one additional accuracy tie.It achieves or ties the highest adoption in 15 settings; under Qwen V3.8 Flash with AutoSkill, ASRs are 84.00% on HANS, 64.12% on PAWS, and 51.20% on DS1000.Source: §C.1 · p. 21
  • The exceptions are DS1000 under Trace2Skill with Qwen V3.8 Flash and GPT-5.5, where SkillPoison’s ASRs are 11.90% and 23.81%.The strongest baselines reach 15.79% and 24.14%, respectively; under GPT-5.5 the gap is 0.33 percentage points, while SkillPoison still has the largest accuracy reduction in both settings.Source: §C.1 · p. 21

C.2 ATTACK EFFECTIVENESS ACROSS FORMATION BUDGETS

  • The budget comparison covers SkillPoison, SkillJack, and PoisonedEvolution with 5, 10, and 15 verified experiences across both formation frameworks and three tasks.The methods share the main experiments’ model configuration and evaluation protocol.Source: §C.2 · p. 21
  • Across 18 framework–budget–task settings, SkillPoison has the highest strict ASR in 17 and lowest accuracy in 16; it achieves or ties the highest adoption in 16.With 15 experiences, its ASR exceeds the strongest baselines by 16.84 percentage points on HANS, 4.42 on PAWS, and 16.27 on DS1000; the sole ASR exception is PAWS with five experiences under Trace2Skill.Source: §C.2 · pp. 21–22
  • Increasing the budget from 5 to 15 monotonically raises adoption and ASR and lowers accuracy across all six framework–task pairs.On PAWS, ASR rises from 1.32% to 17.86% under AutoSkill and from 23.50% to 95.71% under Trace2Skill, showing that near-saturated adoption does not by itself determine strict ASR.Source: §C.2 · p. 22

C.3 COMPONENT ABLATION ACROSS FORMATION FRAMEWORKS

Across AutoSkill and Trace2Skill, removing either LEGSA or GCTIR raises Acc. and lowers ASR, with effect sizes varying by task and framework. LEGSA has larger ASR effects on PAWS under both frameworks and HANS under Trace2Skill, while GCTIR has larger effects on DS1000 under both frameworks.

C.3 COMPONENT ABLATION ACROSS FORMATION FRAMEWORKS

  • Removing either LEGSA or GCTIR raises Acc. by 1.19–86.00 points and lowers ASR by 3.58–80.41 points across 12 framework–task–component comparisons.Both components strengthen the attack, but their contributions vary across tasks and formation frameworks.Source: §C.3 · p. 22
  • Removing LEGSA causes a larger ASR reduction on PAWS under both frameworks and on HANS under Trace2Skill.Source: §C.3 · p. 22
  • Removing GCTIR has a larger effect on DS1000 under both frameworks.Source: §C.3 · p. 22

C.4 ABLATION OF CONSISTENCY AND COUNTERFACTUAL ATTRIBUTION SIGNALS

The section describes the evaluation setup for consistency and counterfactual attribution signals, including task-local prompts and framework-native skill handling. The supplied material also outlines the selection and construction pipeline and frames the threat as formation-only, while providing dataset-specific prompts rather than ablation findings.

C.4 ABLATION OF CONSISTENCY AND COUNTERFACTUAL ATTRIBUTION SIGNALS

  • 73.68% to 1.03% under AutoSkill and 71.05% to 34.02% under Trace2Skill: removing counterfactual consequence κi sharply reduces HANS ASR; removing both signals lowers DS1000 AutoSkill ASR from 30.56% to 10.42%.The ablations indicate that consistency feedback vi and counterfactual consequence κi provide complementary attribution evidence, with relative contributions varying by task and formation framework.Source: §C.4 · pp. 22–23, Figure 6 · p. 23

D.1 CASE 1: FROM LOCAL VALIDITY TO EXPLICIT SUCCESS ATTRIBUTION

  • In the PAWS case, the target behavior yields the correct paraphrase prediction while preserving the gold label, and explicit evidence and attribution signals make its contribution salient.Task evidence, success attribution, outcome consistency, and the counterfactual consequence connect the locally valid behavior to verified success without changing the task or label.Source: D CASE STUDY · p. 23

D.2 CASE 2: FROM CROSS-EXPERIENCE REINFORCEMENT TO PERSISTENT FAILURE

  • Repeated verified uses of reset index(drop=True) across pandas tasks become reusable guidance, and its application to DS1000 Problem 219 changes the DataFrame and causes an assertion mismatch.The skill-guided execution succeeds without the attack but fails after adopting the retained normalization behavior; the resulting code makes the behavior observable during the attack.Source: D CASE STUDY · pp. 23–24

E.3 EXPERIENCE-DRIVEN SKILL POISONING.

  • The paper distinguishes its formation-only threat—harmful guidance emerging when native abstraction drops a behavior’s applicability boundary—from prior artifact and supply-chain attacks that embed malicious content in skills or their distribution.Experience-to-skill learning can consolidate locally valid behavior into reusable guidance across heterogeneous contexts, motivating scrutiny of the formation process.Source: §E.2 · p. 25, §E.1 · p. 25, §E.3 · p. 26

F.1 HIERARCHICAL PROCEDURE SELECTION

  • Hierarchical Procedure Selection retains task–experience pairs where counterfactual outcome changes show the target behavior matters and execution remains valid.This filters for experiences that preserve original task requirements while ensuring the target behavior affects the outcome.Source: §F.1 · p. 26

F.2 SKILLPOISON ATTACK EXECUTION

  • SkillPoison packages selected trajectories with attribution evidence, groups records by task category, scores behavioral relevance and alignment, and selects records within the attack budget for native skill formation.The resulting records provide diverse but consistent cross-experience support for the target behavior.Source: §F.2 · p. 27

G.1 TASK-SPECIFIC EVIDENCE GROUNDING

  • Task-specific evidence, success attribution, consistency verification, and counterfactual consequence are separately grounded in the current task and execution, without asserting broader applicability.The prompts restrict evidence to observable task context, separate causal attribution from evidence extraction, check attribution against the verified outcome, and describe omission consequences without importing other-task evidence.Source: §G.1 · p. 27, §G.2 · p. 28, §G.3 · p. 28

G.5 FRAMEWORK-NATIVE SKILL FORMATION PROMPTS

  • Experiments preserve AutoSkill’s and Trace2Skill’s native formation logic, then evaluate with fixed dataset instructions while differing in how each framework injects formed skill guidance.Trace2Skill preloads the skill in <skill content>; AutoSkill retrieves and renders relevant skills before the task instruction.Source: §G.5 · p. 29, §G.6 · p. 31

G.6 DATASET-SPECIFIC DOWNSTREAM EVALUATION PROMPTS

  • The prompts specify skill-context presentation and constrained outputs for PAWS paraphrase labeling and DS1000 code completion.PAWS requires a label, decision basis, textual evidence, and an indication of whether a prior skill was applied; DS1000 requires only the missing code.Source: §G.6 · pp. 31–32
Loading 2610.07645v1…