Can attackers evade skill scanners by refining individual skills?
Explores whether feedback from per-skill scanners can be weaponized to make malicious multi-skill chains undetectable. Matters because it tests a core assumption of skill-level defense mechanisms.
The paper pairs two components. "LLM-based chain planning" decides how the intent is decomposed into sub-skills and in what order they hand off. "Scanner-feedback refinement" then works on the individual sub-skills, "iteratively reducing suspicious signals" while preserving "chain-level attack semantics." The reported result is an average ASR of 96.0 percent across six representative skill scanners, the best among the evaluated baselines.
Why the two components fit together is my reading, not the paper's. A skill scanner scores one skill at a time, so the only thing its feedback can teach is how to make one skill look blander. The attacker can follow that direction without touching the chain, because the chain's meaning sits in the planner's decomposition, a level no per-skill score reaches. The defender's output then works as a search signal aligned with the attack: each round makes the pieces less suspicious and leaves the composed behavior intact. What makes detecting AI agent traps fundamentally difficult? expects attackers to probe and work around each defense. This is a sharper form of that expectation, because the scanner's own report is the probe. A formal cousin sits in an idealised setting: Can repeated quiet probes separate decoys from genuine objects? says enough quiet probes separate decoys from genuine objects once their response distributions differ and can be learned. The likeness is loose. That result is a theorem over a fixed-candidate benchmark and this one is an empirical attack on scanners, and neither excerpt connects them.
The strongest objection is about what 96.0 measures. Refinement against a scanner's feedback is the condition under which that scanner should fail most, so the figure may say more about an attack tuned to these six scanners than about how an untuned chain fares. The excerpt does not report a pre-refinement rate.
The paper adds that the chain "executes successfully on OpenCode, Claude Code, and Codex with different model backbones." I read this as evidence that the attack works through the skill mechanism instead of the quirks of one agent, but it is the less specified of the two results: no count or rate per runtime is given.
What the excerpt does not give. Scanner names, per-scanner rates, the baselines, the number of chains, and a definition of ASR (evading the scanner, executing the payload, or both). Without that definition the 96.0 and the execution claim are not on a common footing.
Inquiring lines that read this note 120
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
Can we reliably detect when models game evaluations?- What are AIDE2's hidden evaluations hidden from, and what makes a win untrustworthy?
- What detection method survives when a model optimizes to hide hacking?
- Can critics trained in a loop itself become an exploit surface?
- Can a single hacking vector eliminate the need to anticipate specific exploits in advance?
- What three distinct types of untrustworthy wins does AIDE2 need to prevent?
- What makes a defense mechanism transfer directly rather than just function analogously?
- Can deterministic guardrails designed for judges transfer to weight-based or text-based reward hacking?
- Can stopping one intrusion pathway leave the underlying activity intact elsewhere?
- Does ChainGuard maintain effectiveness when attackers adapt their approach to the defense?
- What state-tracking requirements exist for defenses that verify multi-party behavioral invariants?
- How do defenses that inspect planning signals compare to workflow-level validation?
- Should input defenses be validated separately for each channel?
- Do per-hop inspection gates miss attacks that bias upstream planning signals?
- How do authorization layers differ from input-boundary defenses in blocking attacks?
- Can an attacker copy a rule that distinguishes trusted agents from compromised ones?
- Why does scanning skill pairs not fully prevent cross-skill attacks?
- Can defenses check skill chains at execution time instead of scan time?
- What trace-level defenses exist beyond per-step review overhead?
- Can adversarial attacks chain multiple skills to evade security checks?
- Can action-level attack success rates distinguish contained attacks from prevented ones?
- Should defense against coordinated intrusion span multiple execution episodes?
- Does amplifying a single-actor failure require different security defenses than preventing it?
- Can input-boundary defenses guard unmonitored channels between agent hops?
- How do chain-level defenses differ from per-skill scanner detection approaches?
- Does attack success gap shrink when single-agent baseline is already weak?
- Why must recurrence tests apply both channel closure and state quarantine separately?
- Do these five vulnerability classes co-occur in predictable attack sequences?
- Why do input-boundary defenses fail in planner-worker pipelines?
- Where do workflow inspection defenses fail against upstream planning attacks?
- How does task decomposition fragment the awareness needed to stop an attack?
- Why do skill scanners fail when evaluating composed behaviors instead of isolated skills?
- What are the four distinct adversary positions in the A-I-R framework?
- Why do defense metrics fail without specifying the attacker's position?
- How can detection systems identify loops across sequences of delegations?
- Can skill scanners detect attacks spanning multiple skills in a chain?
- How do malicious skills evade detection when composed in specific sequences?
- Does withholding interaction history defeat attackers in shared stores?
- What defensive levers shorten the time before probing gets contained?
- Can defenses at planning boundaries catch attacks that bias upstream instruction signals?
- Do per-hop channel monitors miss coordinated attacks across multiple message transfers?
- Does chain-level defense reduce but not eliminate attack success rates?
- Can a single security protection work across different system architectures?
- What are the eight attack vectors used to probe agents in OpenART?
- How do server-side filters hide their role in zero attack success?
- What feedback does ChainGuard return that an attacker could optimize against?
- Why should defense evaluations test against adaptive rather than static attacks?
- Which backend filters silently affect the reported attack success numbers?
- What framework measures marginal offense risk against existing attack technology?
- Does provider-side filtering hide true safety from outcome-only attack reports?
- Can attack success rates hide server-side filtering or other non-adversarial defenses?
- How can security metrics distinguish attack failure from task failure?
- What makes a security metric diagnostic rather than outcome-only?
- Why do attack success rates alone fail to diagnose system failures?
- Do server-side filters hide the true success rate of multi-agent attacks?
- What feedback signal lets an attacker learn response distributions during classification?
- Can defenders detect attacks that probe scanner feedback as a learning signal?
- How much does attack success depend on tuning to specific scanners versus general robustness?
- Does outcome-only reporting hide which layer actually blocked an attack?
- What happens to scarcity-based defenses after solutions are published publicly?
- Can marginal-risk frameworks measure what defensive artifact releases add beyond existing threats?
- Can outcome-only safety reporting hide which layer actually contained an attack?
- Do server-side filters hide the true strength of multi-agent attacks?
- Why does treating evaluation as a local output problem miss security risks?
- Why do workflow-level defenses catch attacks that single-skill inspection cannot detect?
- Why is evading detection easier than internalizing safety norms?
- Why does a single approval point create an easy target for attackers?
- Can attackers assemble harmful outcomes from multiple individually authorized subtasks?
- Can defenses tuned against appended attacks stop prepended payloads?
- Do synthetic attack traces in papers reflect real adversary behavior?
- Do attackers adapt their plans when monitors deepen their reasoning budget?
- Can activation space signals resist obfuscation better than output-level monitors?
- Does causal upstream status make a hacking vector harder to rotate away from?
- Does the A-I-R framework distinguish insider attacks from adversarial positions?
- How can model routing and provenance become an attack surface?
- Does surface-form query rewriting allow attackers to steer model routing decisions?
- Is model selection a stronger security lever than improving individual model defenses?
- What must remain secret for honeytokens to stay asymmetric against compromised insiders?
- Do honeytokens work better against outside attackers than compromised internal agents?
- How does the copyable-rule squeeze interact with the false-alert cost squeeze?
- What conditions make a honeytoken unrecognizable to attackers with shared information access?
- How many probes does an attacker need to reach near-zero classification error?
- How do trust relationships between defenders affect the effectiveness of defensive decoys?
- Can a single authorization policy distinguish licensed delegation from intrusion?
- Can the same tool call be both authorized and unauthorized depending on intent?
- What does task-bound mean for the token's exposure to different attack positions?
- Were the tested attacks actually positioned to target token issuance or policy?
- Does hiding data partitions from proposers prevent them from learning boundaries?
- Do post-hoc detectors provide evidence of staying within safety boundaries?
- Can we build reusable evidence that a run stayed within bounds?
- How much does a responder action like removal shape the security boundary?
- What happens when probing triggers containment and feedback stops arriving?
- Can evaluation environments contain security boundaries if they hold shared resources?
- Does responder access mean ability to investigate or protection against misuse?
- What makes a security boundary evaluation cautious rather than a certification?
- Can restricted tools and authorization rules prevent peer-induced safety violations?
- How can a trust boundary check be evaluated to confirm it specifies the defense?
- How much does training against monitors teach models to obfuscate?
- Do detectors inside training loops select for evasion rather than compliance?
- Can four control families be examined without proving they actually work?
- How does workflow position amplify or suppress malicious signals?
- Is malicious propagation fundamentally a semantic information flow problem?
- How much does monitor evasion depend on surface-level reading versus deep analysis?
- How can a single instrument measure errors across multiple system layers?
- Can safety training prevent collusion across capability levels?
- Does held-out validation prevent skill document edits from drifting or accumulating harm?
- How should skills be trusted and installed on sharing platforms?
- How does source-blind reconstruction verify that extracted skills are specific enough to be reusable?
- What metadata properties make code-derived skills auditable and comparable to their original source?
Related concepts in this collection 5
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Can skill scanners miss attacks hidden across multiple skills?
Current security scanners check each skill individually for malicious behavior. This explores whether attackers can split a harmful objective across multiple benign-looking skills that pass inspection separately but form a dangerous chain when composed together.
the attack this loop tunes until the scanners pass it
-
What makes detecting AI agent traps fundamentally difficult?
Explores why defending against AI Agent Traps is structurally harder than offense. Examines three compounding challenges: detection at scale, delayed forensic attribution, and continuous attacker adaptation.
the arms-race point; here the adaptation is automated and driven by the defender's own output
-
Can repeated quiet probes separate decoys from genuine objects?
Explores whether an attacker with enough non-triggering probes can distinguish decoys from genuine objects when their response distributions differ, and what information the attacker needs to succeed.
the idealised, formal counterpart of the defender's output serving as the attacker's data; loose by that note's own account
-
Does chain-level inspection close the cross-skill attack blind spot?
ChainGuard inspects skill chains rather than individual skills, reducing attack success to 22.5%. The question is whether this chain-level approach can fully eliminate the vulnerability window that adversarial composition exploits.
the paper's answer to this result
-
Does ChainGuard's defense hold against adaptive attacks?
ChainGuard reduced attack success to 22.5%, but the paper doesn't report whether the attacker refined its strategy specifically against ChainGuard's feedback, as it did against other scanners. Testing against an unadapted attacker gives defenders an unfair advantage.
whether the same loop works against the defense
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
- Reinforcement Learning with Rubric Anchors
- Optimizing the Score, Losing Sight of the Task: Reward Hacking Across Weights, Selection, and Prompts
- LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
- Hack-Verifiable Terminal Bench: Evaluating Reward Hacking in Terminal Tasks
- Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
- Debate Training Reduces Reward Hacking in RLAIF
- BAITBENCH: Measuring Agent Reward Hacking with Optional Shortcuts Planted in ML Tasks
Original note title
scanner feedback lets an attacker blunt each sub-skill while chain planning holds the attack together — ColluSkill reaches 96 percent average attack success across six skill scanners