Search papers, labs, and topics across Lattice.
This paper introduces a novel method for embedding skill watermarks in large language model (LLM) prompts, enabling covert channels for private information encoding through observable traffic patterns. By inserting benign prompt constraints into skill descriptions, the authors demonstrate that an adversary can decode sensitive information from the generated traffic without directly exfiltrating data. Experimental results show that these watermarks produce consistent and distinguishable traffic patterns while evading existing LLM security audits, highlighting a new attack vector in LLM security.
Covert channels in LLM traffic can leak private information without any malicious intent, revealing a surprising vulnerability in seemingly benign interactions.
Skills for large language model (LLM) agents have been widely deployed across diverse application domains. However, we observe that these skills generate specific traffic patterns during execution. In this paper, we design a pipeline that generates specific traffic patterns by inserting carefully designed skill descriptions, which we term skill watermarks, so that a passive network attacker can establish a covert channel to encode private information within observable traffic across multiple conversation turns. Specifically, we insert prompt constraint terms, referred to as watermarks, into the original skill descriptions and embed them within multi-turn conversations. The key information in the user's original prompt is thereby triggered by these watermarks, producing clearly observable encodings in the traffic. The adversary need only decode the traffic patterns to recover the encoded information. In particular, our modifications are benign in the sense that they do not directly exfiltrate any private data and do not execute any malicious instructions. Extensive experiments demonstrate that our watermarks produce highly consistent and distinguishable traffic patterns, and that the transformed skills pass existing LLM-based security auditing tools. This study highlights that generating specific traffic patterns can be exploited as a novel attack surface and offers critical insights for future security hardening.
