Reference answers poison backdoors in skill optimization
Original title: When Feedback Becomes a Backdoor: Tracing Backdoor Skill Formation in Text-Space Skill Optimization
Poisoned reference answers induce persistent trigger-conditioned backdoors in SkillOpt.
Poisoning reference answers creates backdoors in text-space Skill optimization. In SearchQA the natural attack retains exact rules in all three seeds with 200/200 triggered activation. In SpreadsheetBench bottlenecks in the Analyst and edit-budget ranking prevent exact rule formation.
- Exact rules in all three SearchQA seeds
- 200/200 triggered activation
- Bottlenecks in Analyst and edit-budget ranking
- No exact rule in SpreadsheetBench seeds
From the original article
1 min read at arxiv.orgReference answers are a supervision channel in text-space Skill optimization, which produces reusable text artifacts called Skills that guide future agent behavior. Poisoning those answers can induce a persistent trigger-conditioned rule without giving the attacker access to the model, optimizer, or Skill file.
By Louise Nayeong Koh · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.