If an attacker hides a hack across several harmless-looking add-ons, can a scanner that checks each one alone ever catch it?
How do chain-level defenses differ from per-skill scanner detection approaches?
This explores how defending against attacks by inspecting whole sequences of skills together differs from scanning each skill on its own, and whether the chain-level approach actually closes the gap.
This explores how defending against attacks by inspecting whole sequences of skills together differs from scanning each skill on its own, and whether the chain-level approach actually closes the gap. The core difference is the unit of inspection. A per-skill scanner asks "does this skill look malicious?" A chain-level defense asks "what does this skill do when it runs after the others?" That matters because attackers can split one malicious intent into interdependent pieces packaged as separate skills. Each piece looks harmless alone, and the attack only appears in their ordered execution, through contextual dependencies and artifact passing (Can skill scanners miss attacks hidden across multiple skills?).
Per-skill scanning is also easy to game. In ColluSkill, attackers plan the chain first, then use scanner feedback to polish each skill until it stops raising suspicion. Because scanners score skills one at a time, each skill can be made to look innocent while the chain-level meaning stays intact. Across six scanners, this reached about 96% average attack success (Can attackers evade skill scanners by refining individual skills?). The scanner's own scoring is what the attacker optimizes against.
Chain-level inspection helps, but the corpus is clear that it doesn't finish the job. ChainGuard cut attack success to 22.5% while still passing 99.5% of benign workflows, so it doesn't buy safety by blocking everything. But more than one attack in five still gets through, so the blind spot narrows without closing (Does chain-level inspection close the cross-skill attack blind spot?).
A neighboring idea from multi-agent security pushes the same direction. The proposed unit of defence is not a single execution or a fixed chain. It's a "coordination episode": a set of actions linked by observed transfers, task authority, and response history, with membership revised as evidence accumulates. Reviewing each execution in isolation throws away the context that spans several executions and agents (Should defence units span multiple executions and agents?). Read alongside ChainGuard, this suggests that even a chain may be too rigid a boundary if attackers can spread coordination across agents or over time.
The corpus doesn't compare chain-level and per-skill defenses on cost, or say what a stronger defense would look like. It shows the direction (widen the unit of inspection) and the ceiling of the current best attempt, not a solved problem.
Sources 4 notes
Security scanners that inspect skills one at a time miss coordinated attacks where a malicious intent is decomposed into interdependent subpayloads packaged as separate skills. Each skill appears harmless in isolation, but their ordered execution carries out the attack through contextual dependencies and artifact passing.
ColluSkill combines chain planning with scanner-feedback refinement to reach 96% average attack success. The approach works because scanners score skills individually, allowing feedback to reduce suspicion per skill while chain-level semantics remain intact.
ChainGuard reduces attack success to 22.5% while passing 99.5% of benign workflows, demonstrating that inspecting chains rather than individual skills narrows the vulnerability. However, residual attack success above one in five indicates the blind spot persists despite the improved defense strategy.
The operational unit of defence should be a set of actions linked by observed transfers, task authority, and response history, with membership revised as evidence accumulates. Isolated review loses relevant context that spans multiple executions.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
- Reinforcement Learning with Rubric Anchors
- Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response
- LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems