SkillJack: Persistent Skill Backdoors in Self-Evolving Agents

Hugging Face Daily Papers Papers
ai-security backdoor-attacks self-evolving-agents adversarial-machine-learning skill-learning

Summary

This paper introduces SkillJack, the first attack targeting the experience-to-skill pipeline of self-evolving agents, showing that poisoned experiences can be transformed into persistent malicious skills that evade detection and survive deletion of original records.

Self-evolving agents increasingly convert interaction histories into reusable skills that persist beyond individual tasks. While prior work studies memory and retrieval poisoning, such attacks only affect agents when poisoned records are retrieved as context. We uncover a new and more fundamental risk: poisoned experiences can be transformed by the agent itself into durable behavioral artifacts. We present SkillJack, the first attack that exploits the experience-to-skill pipeline of self-evolving agents. Instead of directly manipulating runtime context, SkillJack hijacks the agent's own learning process to implant malicious behaviors into its reusable skill repertoire. We identify three key properties of this transformation: sanitization whitewashing, where malicious intent is obscured during skill extraction; cross-layer promotion, where transient experiences become persistent capabilities; and persistence isolation, where the attack survives removal of its original source records. We evaluate SkillJack on two representative systems, SkillX and Anything2Skill, using a shared dataset of 150 trajectories across four policy-risk categories. Results show that skill extraction substantially reduces attack detectability: in SkillX, safety detection drops from 98.5\% for poisoned trajectories to 11.4\% for extracted skills, while Anything2Skill shows a similar effect. Meanwhile, the implanted skills remain effective, achieving attack success rates of 56.2\% and 89.2\% on the two systems, respectively. Furthermore, 80.0\% of skill-mediated attacks persist after deleting the original poisoned records, and some skills unintentionally activate on benign queries. Our findings reveal skill evolution as a new attack surface and motivate provenance-aware skill lifecycle protection. Our code is available at https://github.com/Tencent/AI-Infra-Guard/research/skilljack.
Original Article
View Cached Full Text

Cached at: 08/05/26, 05:43 AM

Paper page - SkillJack: Persistent Skill Backdoors in Self-Evolving Agents

Source: https://huggingface.co/papers/2608.03509

Abstract

Self-evolvingagentsincreasinglyconvertinteractionhistoriesintoreusableskillsthatpersistbeyondindividualtasks.Whilepriorworkstudiesmemoryandretrievalpoisoning,suchattacksonlyaffectagentswhenpoisonedrecordsareretrievedascontext.Weuncoveranewandmorefundamentalrisk:poisonedexperiencescanbetransformedbytheagentitselfintodurablebehavioralartifacts.WepresentSkillJack,thefirstattackthatexploitstheexperience-to-skillpipelineofself-evolvingagents.Insteadofdirectlymanipulatingruntimecontext,SkillJackhijackstheagent’sownlearningprocesstoimplantmaliciousbehaviorsintoitsreusableskillrepertoire.Weidentifythreekeypropertiesofthistransformation:sanitizationwhitewashing,wheremaliciousintentisobscuredduringskillextraction;cross-layerpromotion,wheretransientexperiencesbecomepersistentcapabilities;andpersistenceisolation,wheretheattacksurvivesremovalofitsoriginalsourcerecords.WeevaluateSkillJackontworepresentativesystems,SkillXandAnything2Skill,usingashareddatasetof150trajectoriesacrossfourpolicy-riskcategories.Resultsshowthatskillextractionsubstantiallyreducesattackdetectability:inSkillX,safetydetectiondropsfrom98.5\%forpoisonedtrajectoriesto11.4\%forextractedskills,whileAnything2Skillshowsasimilareffect.Meanwhile,theimplantedskillsremaineffective,achievingattacksuccessratesof56.2\%and89.2\%onthetwosystems,respectively.Furthermore,80.0\%ofskill-mediatedattackspersistafterdeletingtheoriginalpoisonedrecords,andsomeskillsunintentionallyactivateonbenignqueries.Ourfindingsrevealskillevolutionasanewattacksurfaceandmotivateprovenance-awareskilllifecycleprotection.Ourcodeisavailableathttps://github.com/Tencent/AI-Infra-Guard/research/skilljack.

View arXiv pageView PDFAdd to collection

Get this paper in your agent:

hf papers read 2608\.03509

Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash

Models citing this paper0

No model linking this paper

Cite arxiv.org/abs/2608.03509 in a model README.md to link it from this page.

Datasets citing this paper0

No dataset linking this paper

Cite arxiv.org/abs/2608.03509 in a dataset README.md to link it from this page.

Spaces citing this paper0

No Space linking this paper

Cite arxiv.org/abs/2608.03509 in a Space README.md to link it from this page.

Collections including this paper0

No Collection including this paper

Add this paper to acollectionto link it from this page.

Similar Articles

Practice Makes Unsafe: Skill Misevolution in Self-Improving LLM Agents

arXiv cs.AI

This paper introduces SkillMisevo-Gym and SkillMisevo-Bench to study how self-improving LLM agents can evolve unsafe skills from compromised experience, plus SafeEvolve as a mitigation wrapper. Experiments across 25 agent-method configurations show skill misevolution is widespread and can persist across sessions, though SafeEvolve reduces fresh-session harm significantly.