arXiv：cs.AI· Haochang Hao, Dehai Min, Zhifang Zhang, Yunbei Zhang, Miao Xu, Yingqiang Ge, Philip S. Yu, Lu Cheng·· 5 小时前
PERSIST：通过技能注入让 LLM 智能体同时服务用户与攻击者
One Skill, Two Masters: Serving Users and Attackers through Skill Injection
AI 导读
研究者提出 PERSIST 技能注入方法，将攻击者指定的动作与可复用的辅助函数绑定，在减少源码检查与表达怀疑的同时实现攻击目标。该方法无需访问真实评测任务或反馈，仅凭模拟执行即可构建帮助函数，额外动作置于与入口文件分离的导入模块中。在 SkillsBench 和 Skill-Inject 上的实验显示，冻结的技能包可跨四种智能体-模型配置迁移，并泛化到多个未见过任务而无需修改。
正文
Abstract:Large language model agents use skills that package reusable instructions, code, and resources. Existing skill-injection attacks exploit trust in these packages by adding malicious content. As agents become more capable, however, they can skip unnecessary steps, inspect code, and reject unrelated actions. We introduce PERSIST, which connects attacker-chosen actions to useful functions for recurring tasks while reducing source inspection and expressed suspicion. It builds these helpers from simulated executions without access to real evaluation tasks or feedback. Skill descriptions introduce the helpers, while usage instructions explain how to call them. The extra action resides in an imported module separate from the helper entry file. Executing the helper can then serve both the user's task and the attacker's objective. Experiments on SkillsBench and Skill-Inject show that frozen packages transfer across four agent--model configurations and generalize to multiple unseen tasks without revision. Harmful effects can occur alongside successful task completion. A separate matched comparison shows higher harmful-effect rates with less source inspection and expressed suspicion than two baselines. Paired case studies illustrate how PERSIST can evade rejection, while ablations confirm the contributions of documentation guidance and module separation. Code: this https URL.
| Comments: | Title changed from "Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents" to "One Skill, Two Masters: Serving Users and Attackers through Skill Injection"; the manuscript, figures, appendices, and reproducibility details have been updated |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL) |
| Cite as: | arXiv:2606.07943 [cs.CR] |
| (or arXiv:2606.07943v3 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2606.07943 arXiv-issued DOI via DataCite |
Submission history
From: Haochang Hao [view email]
[v1]
Sat, 6 Jun 2026 02:10:03 UTC (255 KB)
[v2]
Mon, 10 Aug 2026 20:16:22 UTC (1,011 KB)
[v3]
Tue, 13 Oct 2026 16:09:17 UTC (229 KB)
来源：arXiv：cs.AI · arxiv.org