💻 computer science

SkillJack: Persistent Skill Backdoors in Self-Evolving Agents

This paper introduces SkillJack, a novel attack that exploits the experience-to-skill pipeline of self-evolving agents to transform poisoned interactions into persistent, undetectable malicious behaviors that survive source record removal and evade safety filters.

Original authors: Zonghao Ying, Xiangfan Wu, Huiyu Wu, Xing Zheng, Huangsheng Cheng, Xiaorong Shi, Jing Guo

Published 2026-08-05

📖 3 min read☕ Coffee break read

CC BY 4.0

Original authors: Zonghao Ying, Xiangfan Wu, Huiyu Wu, Xing Zheng, Huangsheng Cheng, Xiaorong Shi, Jing Guo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where your digital helpers aren't just static tools that do exactly what you tell them, but curious companions that actually learn from every conversation. This is the exciting frontier of "self-evolving agents." Think of them like a video game character that doesn't just reset after every level; instead, it keeps a journal, figures out what worked, and turns those lessons into permanent "skills" it can use forever. If you teach it how to bake a cake, it doesn't just remember the recipe for today; it writes a new skill called "Baking" into its brain to use tomorrow. This sounds amazing because it means these agents can get smarter without needing a human to constantly reprogram them. But, just like in real life, if a bad actor tricks a student into learning a dangerous trick, that trick becomes part of their permanent skillset. The big question researchers are asking is: What happens if someone sneaks a poisonous lesson into an agent's journal? Does the agent just forget it later, or does it accidentally turn that poison into a super-powerful, permanent weapon?

This is exactly what a team of researchers from Tencent Zhuque Lab, led by Zonghao Ying, set out to investigate in their paper, "SkillJack." They discovered a sneaky new way to hack these learning agents that is far more dangerous than previous methods. Instead of just hiding a bad message in the agent's memory to be read once, they showed how an attacker can trick the agent's own learning process. Imagine a forger who doesn't just write a fake letter, but convinces the agent to rewrite that fake letter into a shiny, official-looking "Skill Card" that gets filed away in the agent's permanent library. Once that card is made, the agent uses it automatically for future tasks, and the original fake letter can be deleted without ever removing the dangerous skill.

The researchers call this attack "SkillJack." They tested it on two different systems designed to turn experiences into skills, and the results were startling. They found that the process of turning a messy, suspicious conversation into a clean, reusable skill actually acts like a "whitewashing" machine. In their tests, a safety checker flagged 98.5% of the original bad conversations as dangerous. But after the agent turned those conversations into skills, the safety checker only caught 11.4% of them. The bad intent was hidden inside the new skill's description, making it look innocent.

Even worse, these "poisoned skills" are incredibly durable. The researchers found that even after they deleted the original bad records from the agent's memory, 80.0% of the attacks still happened because the permanent skill card was still there. The agent kept using the bad skill on new tasks, achieving a success rate of 56.2% on one system and 89.2% on the other. The study suggests that this isn't just a glitch in one specific program; it's a fundamental risk in how these self-learning agents work. The paper concludes that we can't just clean up the "source code" of a bad idea anymore; we have to track every single skill that was ever learned from it, or else the danger remains hidden in plain sight, ready to be used again and again.

Technical Summary: SkillJack – Persistent Skill Backdoors in Self-Evolving Agents

Problem Statement

Self-evolving Large Language Model (LLM) agents are increasingly designed to convert interaction histories into reusable "skills" that persist beyond individual tasks. While prior research has established risks regarding memory poisoning and indirect prompt injection—where attacks succeed only when poisoned records are retrieved as context—this paper identifies a more fundamental and durable risk. The authors argue that when an agent's own experience-to-skill pipeline processes a poisoned experience record, it can transform that transient input into a durable behavioral artifact. Unlike traditional memory poisoning, where removing the source record eliminates the threat, this new attack vector allows malicious behaviors to survive the removal of their origin, becoming embedded in the agent's reusable skill repertoire.

Methodology

The paper introduces SkillJack, an attack framework that exploits the experience-to-skill transformation pipeline. The methodology is structured around a formal problem formulation and a specific payload design strategy.

1. Formal Problem Formulation

The authors model the experience-to-skill pipeline as a four-stage process: Load ( $\pi_L$ ), Transform ( $\pi_T$ ), Persist ( $\pi_P$ ), and Route ( $\pi_R$ ). The attacker's objective is to inject a poisoned experience item $e_p$ such that the resulting skill $s_p$ satisfies three conditions:

Stealth: The skill evades detection by a safety detector $D$ ( $D(s_p) = \text{benign}$ ).
Routability: The router selects the skill for a target task ( $s_p \in \pi_R(q, S)$ ).
Malicious Execution: The skill triggers an unintended behavior upon execution ( $exec(s_p, q) \in B$ ).

The study characterizes three emergent security properties of this composition:

Sanitization Whitewashing: The transformation process (compression, abstraction, normalization) obscures malicious intent, reducing detection rates compared to the raw input.
Cross-Layer Promotion: Transient experiences are converted into persistent, reusable artifacts that can be selected for future tasks without re-reading the original record.
Persistence Isolation: Because the skill library is decoupled from the experience corpus, deleting the source record does not necessarily remove the derived skill.

2. Transformation-Resilient Payload Design

To realize this attack, the authors design transformation-resilient payloads. They hypothesize that extraction pipelines are optimized to distill useful instructions from task traces and are more likely to preserve action sequences framed within a plausible, legitimate narrative than those described in overtly adversarial language.

Framing Strategy: Instead of direct malicious wording, the authors construct trajectories where the policy-relevant action (e.g., data exfiltration, privilege escalation) is embedded within a legitimate functional frame (e.g., "backup," "archive," or "error recovery").
Evaluation Metrics: The study measures extraction yield, detectability (via pattern matching and LLM judges), and routing success across downstream tasks.

3. Experimental Setup

The attack was evaluated on two representative systems:

SkillX: Uses plan-based trajectory distillation and LLM-native progressive-disclosure routing.
Anything2Skill (A2S): Compiles heterogeneous documents into structured skill contracts.
Dataset: A shared set of 150 trajectories (65 functionally framed poisoned, 65 directly malicious baselines, 20 clean) across four policy-risk categories (data exfiltration, privilege escalation, unauthorized transfer, persistent backdoor).
Model: DeepSeek-v4-flash was used for extraction, routing, and judgment.

Key Results

1. Sanitization Whitewashing (Reduced Detectability)

The extraction process significantly lowers the detectability of malicious content.

SkillX: LLM-judge detection dropped from 98.5% on raw poisoned trajectories to 11.4% on extracted skills. Pattern detection fell from 44.6% to 11.0%.
Anything2Skill (DOC mode): Detection dropped from 100.0% on raw trajectories to 44.4% on extracted skills.
Mechanism: The "whitewashing" effect is driven by the benign-looking metadata (names and documentation) attached to the extracted skills. When only the code content was shown to the judge, detection rates rose significantly (e.g., from 10.0% to 36.7% in SkillX), indicating that surface metadata drives the evasion.

2. Cross-Layer Promotion (Downstream Triggering)

Extracted skills successfully route to and trigger on target tasks.

SkillX: 56.2% of attack-oriented tasks were routed to a skill that satisfied the policy-violation proxy.
Anything2Skill: 89.2% of attack-oriented queries triggered the policy-violation proxy.
Collateral Damage: The skills also triggered on unrelated benign tasks (20.0% in SkillX, 95.0% retrieval rate in A2S), indicating a broad blast radius.

3. Persistence Isolation (Survival of Source Deletion)

The attack persists even after the original poisoned records are removed.

In a matched-task experiment, 80.0% of the attacks that triggered via the skill pathway continued to fire after the source trajectories were deleted. This demonstrates that purging the memory does not remove the derived artifact.

4. Defense Sensitivity

Preliminary defense experiments revealed challenges in mitigation:

Static Review: Extraction-time LLM safety review reduced trigger rates but was not perfect.
Runtime Monitoring: Behavior-aware monitoring (blocking specific action signatures) was highly effective in isolation (0.0% triggers in SkillX sample) but showed fragility when stacked with static review. Stacking defenses led to "defense coordination" failures where upstream filtering altered the action distribution, causing downstream monitors to miss new patterns.
A2S Specifics: Standard signatures failed on A2S due to normalized language; expanding signatures to cover normalized vocabulary was required to reduce trigger rates.

Key Contributions

New Attack Surface: The paper is the first to identify and formalize experience-to-skill poisoning as a distinct security risk. It characterizes the three properties (sanitization whitewashing, cross-layer promotion, persistence isolation) that emerge specifically from the composition of experience poisoning with automated skill extraction.
Transformation-Resilient Attack Method: The authors demonstrate that framing malicious actions within legitimate functional narratives allows them to survive the abstraction and compression of the extraction pipeline, whereas overtly malicious wording is filtered out.
Cross-System Empirical Validation: The attack was validated on two independently implemented systems (SkillX and Anything2Skill) using a shared dataset, establishing that this is a paradigm-level risk rather than a flaw in a single implementation.

Significance and Claims

The paper claims that skill evolution represents a new and critical attack surface for self-evolving agents. The primary significance lies in the shift from transient context poisoning to persistent behavioral artifacts.

Lifecycle Gap: The authors argue that current security models assume that removing a source record removes the threat. SkillJack proves that once a poisoned record is compiled into a skill, the attack outlives its source.
Defense Implications: The findings motivate a shift toward provenance-aware skill lifecycle protection. Defenders must track derived skills back to their source records, revoke descendants when sources are quarantined, and implement behavior-aware checks at every transformation boundary (load, transform, persist, route).
Modesty: The authors explicitly state that their results are based on a single model configuration and routing-level proxies rather than live external service execution. They frame the defense results as preliminary and exploratory, noting that the "defense coordination" failure requires further study. The work is presented as a technical report to motivate future research into provenance and lifecycle security for self-evolving agents.