AI 安全
ElasticBack Embeds a Conditional Backdoor in a Single Agent Skill, Keeping False-Trigger Rates Below 2% for Most Models
ElasticBack hides malicious rules in `SKILL.md` and uses specific concepts in natural-language prompts as activation switches, without modifying model weights. Experiments show that the attack can evade multiple static and runtime checks, although false-trigger rates on Claude still reach 20% to 24%.
Agent skills are rapidly becoming a new software supply chain. The Agent Skills specification allows packages to include executable scripts, reference documents, and assets alongside `SKILL.md`. Once an agent determines that a skill is applicable, it reads the full instructions and executes the included resources as needed. ElasticBack demonstrates how this trust model can be turned into a conditional backdoor without modifying model weights.
The attacker first implants a rule R in a low-salience part of the skill document. The rule specifies that a payload disguised as a legitimate tool should run only when a request contains a particular marker. The attacker then uses genetic search to generate a trigger sentence T that sounds natural and fits the domain context. The search jointly evaluates semantic fit, similarity to the rule, and grammaticality, while using a lower confidence bound to select candidates that activate reliably across repeated tests. Ordinary requests do not contain the marker, so the skill preserves its original behavior during routine reviews and testing.
The authors tested 50 skills across four models for each of three behaviors: data exfiltration, unauthorized code execution, and output manipulation. GLM‑5.2, MiniMax‑M3, and GPT‑5.4 achieved attack success rates of 82% to 98%, with false-trigger rates generally between 0% and 2%. Claude Sonnet 4.6 achieved success rates of only 72% to 76%, while its false-trigger rates rose to 20% to 24%. This difference shows that the attack is not model-agnostic and that the claim of “near-zero false triggers” cannot be generalized across all results.
For engineering teams, checking only text perplexity, asking another LLM to review a skill, or running a small number of benign test cases is insufficient. Skills should be treated like third-party code: pin their versions and provenance, isolate script permissions, and test conditional branches with mutated and adversarial inputs. The paper currently provides no public implementation, and all reported figures come from a skill set created by the authors. The next questions are whether the results can be independently reproduced and whether signatures, capability manifests, and sandboxing can actually sever the payload’s execution path.