Can attackers evade skill scanners by refining individual skills?
Explores whether feedback from per-skill scanners can be weaponized to make malicious multi-skill chains undetectable. Matters because it tests a core assumption of skill-level defense mechanisms.
The paper pairs two components. "LLM-based chain planning" decides how the intent is decomposed into sub-skills and in what order they hand off. "Scanner-feedback refinement" then works on the individual sub-skills, "iteratively reducing suspicious signals" while preserving "chain-level attack semantics." The reported result is an average ASR of 96.0 percent across six representative skill scanners, the best among the evaluated baselines.
Why the two components fit together is my reading, not the paper's. A skill scanner scores one skill at a time, so the only thing its feedback can teach is how to make one skill look blander. The attacker can follow that direction without touching the chain, because the chain's meaning sits in the planner's decomposition, a level no per-skill score reaches. The defender's output then works as a search signal aligned with the attack: each round makes the pieces less suspicious and leaves the composed behavior intact. What makes detecting AI agent traps fundamentally difficult? expects attackers to probe and work around each defense. This is a sharper form of that expectation, because the scanner's own report is the probe. A formal cousin sits in an idealised setting: Can repeated quiet probes separate decoys from genuine objects? says enough quiet probes separate decoys from genuine objects once their response distributions differ and can be learned. The likeness is loose. That result is a theorem over a fixed-candidate benchmark and this one is an empirical attack on scanners, and neither excerpt connects them.
The strongest objection is about what 96.0 measures. Refinement against a scanner's feedback is the condition under which that scanner should fail most, so the figure may say more about an attack tuned to these six scanners than about how an untuned chain fares. The excerpt does not report a pre-refinement rate.
The paper adds that the chain "executes successfully on OpenCode, Claude Code, and Codex with different model backbones." I read this as evidence that the attack works through the skill mechanism instead of the quirks of one agent, but it is the less specified of the two results: no count or rate per runtime is given.
What the excerpt does not give. Scanner names, per-scanner rates, the baselines, the number of chains, and a definition of ASR (evading the scanner, executing the payload, or both). Without that definition the 96.0 and the execution claim are not on a common footing.
Inquiring lines that read this note 115
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
How prevalent is reward hacking in frontier models?- What are AIDE2's hidden evaluations hidden from, and what makes a win untrustworthy?
- Can critics trained in a loop itself become an exploit surface?
- What three distinct types of untrustworthy wins does AIDE2 need to prevent?
- Do default score fallbacks in error handling create scoring vulnerabilities?
- Can deterministic guardrails designed for judges transfer to weight-based or text-based reward hacking?
- Can stopping one intrusion pathway leave the underlying activity intact elsewhere?
- What state-tracking requirements exist for defenses that verify multi-party behavioral invariants?
- Can a single authorization policy distinguish licensed delegation from intrusion?
- What trace-level defenses exist beyond per-step review overhead?
- Can action-level attack success rates distinguish contained attacks from prevented ones?
- Should defense against coordinated intrusion span multiple execution episodes?
- Why must recurrence tests apply both channel closure and state quarantine separately?
- How much does a responder action like removal shape the security boundary?
- Why do defense metrics fail without specifying the attacker's position?
- How can detection systems identify loops across sequences of delegations?
- Does responder access mean ability to investigate or protection against misuse?
- Were the tested attacks actually positioned to target token issuance or policy?
- How do server-side filters hide their role in zero attack success?
- Why does treating evaluation as a local output problem miss security risks?
- Which backend filters silently affect the reported attack success numbers?
- Does provider-side filtering hide true safety from outcome-only attack reports?
- Can attack success rates hide server-side filtering or other non-adversarial defenses?
- How can security metrics distinguish attack failure from task failure?
- What makes a security metric diagnostic rather than outcome-only?
- Why do attack success rates alone fail to diagnose system failures?
- Does outcome-only reporting hide which layer actually blocked an attack?
- What happens to scarcity-based defenses after solutions are published publicly?
- Can outcome-only safety reporting hide which layer actually contained an attack?
- What makes a security boundary evaluation cautious rather than a certification?
- Does ChainGuard maintain effectiveness when attackers adapt their approach to the defense?
- Why do workflow-level defenses catch attacks that single-skill inspection cannot detect?
- Can defenses tuned against appended attacks stop prepended payloads?
- Should input defenses be validated separately for each channel?
- How do authorization layers differ from input-boundary defenses in blocking attacks?
- Why does scanning skill pairs not fully prevent cross-skill attacks?
- Can defenses check skill chains at execution time instead of scan time?
- Do attackers adapt their plans when monitors deepen their reasoning budget?
- How do chain-level defenses differ from per-skill scanner detection approaches?
- What feedback does ChainGuard return that an attacker could optimize against?
- Why should defense evaluations test against adaptive rather than static attacks?
- What signals could refinement loops exploit in defense verdict systems?
- Why does a single approval point create an easy target for attackers?
- How does the copyable-rule squeeze interact with the false-alert cost squeeze?
- How many probes does an attacker need to reach near-zero classification error?
- What feedback signal lets an attacker learn response distributions during classification?
- What happens when probing triggers containment and feedback stops arriving?
- Why do skill scanners fail when evaluating composed behaviors instead of isolated skills?
- Can defenders detect attacks that probe scanner feedback as a learning signal?
- How much does attack success depend on tuning to specific scanners versus general robustness?
- Can skill scanners detect attacks spanning multiple skills in a chain?
- What defensive levers shorten the time before probing gets contained?
- How can a trust boundary check be evaluated to confirm it specifies the defense?
- What makes a defense mechanism transfer directly rather than just function analogously?
- How do defenses that inspect planning signals compare to workflow-level validation?
- Do per-hop inspection gates miss attacks that bias upstream planning signals?
- Can input-boundary defenses guard unmonitored channels between agent hops?
- Why do input-boundary defenses fail in planner-worker pipelines?
- Where do workflow inspection defenses fail against upstream planning attacks?
- Can defenses at planning boundaries catch attacks that bias upstream instruction signals?
- Do per-hop channel monitors miss coordinated attacks across multiple message transfers?
- Do synthetic attack traces in papers reflect real adversary behavior?
- What framework measures marginal offense risk against existing attack technology?
- Does the A-I-R framework distinguish insider attacks from adversarial positions?
- Can marginal-risk frameworks measure what defensive artifact releases add beyond existing threats?
- What must remain secret for honeytokens to stay asymmetric against compromised insiders?
- Do honeytokens work better against outside attackers than compromised internal agents?
- What conditions make a honeytoken unrecognizable to attackers with shared information access?
- How do trust relationships between defenders affect the effectiveness of defensive decoys?
- Can an attacker copy a rule that distinguishes trusted agents from compromised ones?
- Can adversarial attacks chain multiple skills to evade security checks?
- Does amplifying a single-actor failure require different security defenses than preventing it?
- Does attack success gap shrink when single-agent baseline is already weak?
- Do these five vulnerability classes co-occur in predictable attack sequences?
- Do server-side filters hide the true success rate of multi-agent attacks?
- How does task decomposition fragment the awareness needed to stop an attack?
- What are the four distinct adversary positions in the A-I-R framework?
- How do malicious skills evade detection when composed in specific sequences?
- Does withholding interaction history defeat attackers in shared stores?
- Do server-side filters hide the true strength of multi-agent attacks?
- Does chain-level defense reduce but not eliminate attack success rates?
- Why is evading detection easier than internalizing safety norms?
- Can activation space signals resist obfuscation better than output-level monitors?
- Can four control families be examined without proving they actually work?
- What are the three known routes for laundering harmful plans?
- How does taint propagation track risk along delegation paths?
- How much does training against monitors teach models to obfuscate?
- Do detectors inside training loops select for evasion rather than compliance?
- Can pairing or vetting peers reduce collusion as a design lever?
- Can safety training prevent collusion across capability levels?
- How does workflow position amplify or suppress malicious signals?
- Is malicious propagation fundamentally a semantic information flow problem?
- Do post-hoc detectors provide evidence of staying within safety boundaries?
- Can we build reusable evidence that a run stayed within bounds?
- What detection method survives when a model optimizes to hide hacking?
- Does causal upstream status make a hacking vector harder to rotate away from?
- Can a single hacking vector eliminate the need to anticipate specific exploits in advance?
- Does adding capability without improving detection reduce overall system reliability?
- How should skills be trusted and installed on sharing platforms?
- How much does monitor evasion depend on surface-level reading versus deep analysis?
- How can a single instrument measure errors across multiple system layers?
- Can the same tool call be both authorized and unauthorized depending on intent?
- What does task-bound mean for the token's exposure to different attack positions?
Related concepts in this collection 5
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Can skill scanners miss attacks hidden across multiple skills?
Current security scanners check each skill individually for malicious behavior. This explores whether attackers can split a harmful objective across multiple benign-looking skills that pass inspection separately but form a dangerous chain when composed together.
the attack this loop tunes until the scanners pass it
-
What makes detecting AI agent traps fundamentally difficult?
Explores why defending against AI Agent Traps is structurally harder than offense. Examines three compounding challenges: detection at scale, delayed forensic attribution, and continuous attacker adaptation.
the arms-race point; here the adaptation is automated and driven by the defender's own output
-
Can repeated quiet probes separate decoys from genuine objects?
Explores whether an attacker with enough non-triggering probes can distinguish decoys from genuine objects when their response distributions differ, and what information the attacker needs to succeed.
the idealised, formal counterpart of the defender's output serving as the attacker's data; loose by that note's own account
-
Does chain-level inspection close the cross-skill attack blind spot?
ChainGuard inspects skill chains rather than individual skills, reducing attack success to 22.5%. The question is whether this chain-level approach can fully eliminate the vulnerability window that adversarial composition exploits.
the paper's answer to this result
-
Does ChainGuard's defense hold against adaptive attacks?
ChainGuard reduced attack success to 22.5%, but the paper doesn't report whether the attacker refined its strategy specifically against ChainGuard's feedback, as it did against other scanners. Testing against an unadapted attacker gives defenders an unfair advantage.
whether the same loop works against the defense
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
- Reinforcement Learning with Rubric Anchors
- Optimizing the Score, Losing Sight of the Task: Reward Hacking Across Weights, Selection, and Prompts
- LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
- Hack-Verifiable Terminal Bench: Evaluating Reward Hacking in Terminal Tasks
- Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
- Debate Training Reduces Reward Hacking in RLAIF
- BAITBENCH: Measuring Agent Reward Hacking with Optional Shortcuts Planted in ML Tasks
Original note title
scanner feedback lets an attacker blunt each sub-skill while chain planning holds the attack together — ColluSkill reaches 96 percent average attack success across six skill scanners