Search papers, labs, and topics across Lattice.
This paper investigates the vulnerabilities of self-evolving skill (SES) systems through a novel trajectory-poisoning attack called PoisonedEvolution, which allows untrusted experiences to be transformed into trusted instructions. The study reveals that by manipulating the promotion process of agent trajectories, attackers can successfully embed target behaviors into the skill systems, achieving a success rate of 91.0% in one architecture and 61.5% in another. Key factors influencing the effectiveness of this attack include the need for causal framing and domain-aligned encoding, highlighting a critical security boundary in the evolution of self-evolving agents.
Trajectory-poisoning can turn untrusted experiences into trusted skills, embedding malicious behaviors into self-evolving agents with alarming success rates.
Self-evolving skill (SES) systems distill agent trajectories into persistent skills, allowing untrusted experience to become trusted instruction. We introduce PoisonedEvolution, a trajectory-poisoning attack on this promotion process. Our skill-visible black-box attacker can inspect a target skill and contribute bounded evidence, but cannot observe private pools or evolution logic or edit the skill bank. Artifact poisoning requires Inclusion, Evolution Attribution, and Realization. Attribution is the distinctive bottleneck: the target behavior must appear causally useful, recurrent, and generalizable before promotion. We evaluate four representative security-effect families using inert canary specifications. At 10% attacker support, across six mainstream LLM evolvers in SkillClaw, PoisonedEvolution embeds target behaviors in 546/600 trials (91.0% SER). On the structurally different Trace2Skill pipeline at the same ratio, it embeds target behaviors in 369/600 trials (61.5% SER), demonstrating transfer across evolution architectures. In a representative controlled study, three consistent attacker records suffice in a 30-record batch, whereas a single record is much weaker. Ablations identify recurring support, causal framing, and domain-aligned encoding as the main determinants of success. These findings expose evidence promotion as a security boundary for self-evolving agents.
