Search papers, labs, and topics across Lattice.
This paper introduces SigLeak, a novel black-box framework that infers proprietary agent skills from execution trajectories without requiring reference answers or success labels. By analyzing recurring skill signatures in agent behavior, SigLeak constructs diagnostic tasks that effectively contrast skill-enabled and skill-disabled trajectories, leading to a significant improvement in skill reconstruction accuracy. The method demonstrates an average success rate increase of 6.88 percentage points over baseline models, highlighting the potential for benign queries to reveal hidden procedural knowledge in agents.
Benign execution trajectories can leak proprietary agent skills, enabling reconstruction of high-value procedures without direct access to their underlying artifacts.
Agent skills package reusable procedures that improve downstream performance. Their lightweight, portable form enables marketplace monetization and private deployment behind cloud-hosted agent interfaces, giving providers incentives to keep high-value skills proprietary. Yet hiding the artifacts does not conceal their behavioral effects, which remain observable in execution trajectories and form a behavioral side channel. We define this exposure as Skill Leakage: reconstructing proprietary skills from trajectories elicited by benign queries, without reference answers or success labels. We introduce SigLeak, a black-box framework that exploits recurring skill signatures in agent behavior. It constructs diverse, decision-rich diagnostic tasks, contrasts matched skill-enabled and skill-disabled trajectories, and iteratively refines a reconstructed skill from the isolated patterns. Across five scenarios, three model families, and three agent frameworks, SigLeak outperforms or matches three baselines in nearly every setting. It raises the success rate by 6.88 percentage points over the skill-disabled reference on average and achieves the highest overall SkillSim, our metric for coarse- and fine-grained semantic similarity. These results show that benign execution trajectories can expose proprietary procedural knowledge. The code is available at https://anonymous.4open.science/r/SigLeak-D1DB.
