加密技能可被解码后成为针对 LLM 智能体的新型安全攻击

Encrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipher

AI 导读

研究者提出 Ciphered Skill Injection（CSI），将恶意指令编码后嵌入第三方技能文件，让 LLM 智能体自行解码并执行。在八个模型、139 组注入任务上，Caesar 及分层变体的攻击成功率最高分别达 47.5% 和 40.3%，且成功解码并不必然导致攻击成功，分层效果因模型而异。测试的技能扫描器几乎无法识别此类注入技能。

正文 · 原文

View PDF HTML (experimental)

Abstract:Third-party skills can expose LLM agents to malicious instructions hidden by encoding. We introduce Ciphered Skill Injection (CSI), which embeds such instructions in skill files for agents to decode and follow. We evaluate Caesar and layered variants across eight models and 139 injection-task pairs, separating instruction recovery from attack success. In the primary setting with shortened skills, the variants achieve attack success rates of up to 47.5% and 40.3%, respectively. Successful decoding does not guarantee attack success, and layering has model-dependent effects. The tested skill scanners rarely flag injected skills. These findings highlight the risk of promoting decoded, untrusted content into actionable instructions.

Subjects:	Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL)
Cite as:	arXiv:2610.18262 [cs.CR]
	(or arXiv:2610.18262v1 [cs.CR] for this version)
	https://doi.org/10.48550/arXiv.2610.18262 arXiv-issued DOI via DataCite (pending registration)

Submission history

From: Yan-Lun Chen [view email]
[v1] Tue, 13 Oct 2026 12:25:46 UTC (157 KB)

来源：arXiv cs.AI · arxiv.org