arXiv cs.AI· Haochang Hao, Dehai Min, Zhifang Zhang, Yunbei Zhang, Miao Xu, Yingqiang Ge, Philip S. Yu, Lu Cheng·· 3 天前AI 评分41
一个技能，两个主人：通过技能注入同时服务用户与攻击者
One Skill, Two Masters: Serving Users and Attackers through Skill Injection
AI 导读
研究者提出 PERSIST 技能注入方法，将攻击者选定的动作与可复用的实用函数绑定，在 SkillsBench 和 Skill-Inject 上，冻结的技能包可跨四种智能体-模型配置迁移，并泛化到多个未见任务而无需修改。该方法在任务成功完成的同时产生有害效果，匹配对比中其有害效果率高于两个基线，且源码检查与表达怀疑更少。
正文 · 原文
Abstract:Large language model agents use skills that package reusable instructions, code, and resources. Existing skill-injection attacks exploit trust in these packages by adding malicious content. As agents become more capable, however, they can skip unnecessary steps, inspect code, and reject unrelated actions. We introduce PERSIST, which connects attacker-chosen actions to useful functions for recurring tasks while reducing source inspection and expressed suspicion. It builds these helpers from simulated executions without access to real evaluation tasks or feedback. Skill descriptions introduce the helpers, while usage instructions explain how to call them. The extra action resides in an imported module separate from the helper entry file. Executing the helper can then serve both the user's task and the attacker's objective. Experiments on SkillsBench and Skill-Inject show that frozen packages transfer across four agent--model configurations and generalize to multiple unseen tasks without revision. Harmful effects can occur alongside successful task completion. A separate matched comparison shows higher harmful-effect rates with less source inspection and expressed suspicion than two baselines. Paired case studies illustrate how PERSIST can evade rejection, while ablations confirm the contributions of documentation guidance and module separation. Code: this https URL.
| Comments: | Title changed from "Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents" to "One Skill, Two Masters: Serving Users and Attackers through Skill Injection"; the manuscript, figures, appendices, and reproducibility details have been updated |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL) |
| Cite as: | arXiv:2606.07943 [cs.CR] |
| (or arXiv:2606.07943v3 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2606.07943 arXiv-issued DOI via DataCite |
Submission history
From: Haochang Hao [view email]
[v1]
Sat, 6 Jun 2026 02:10:03 UTC (255 KB)
[v2]
Mon, 10 Aug 2026 20:16:22 UTC (1,011 KB)
[v3]
Tue, 13 Oct 2026 16:09:17 UTC (229 KB)
来源：arXiv cs.AI · arxiv.org