黑盒复现隐藏的AI技能功能，仅通过正常调用就能复制其行为。
Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills
- 通过合法请求与响应构建接口假设，逐步生成可执行副本。
- 在30个技能中实现部分或完全功能复现，迭代查询提升准确率。
- 现有防护机制对正常使用场景无效，需防范信息累积泄露。
封闭源代码的智能体技能可能包含专有的指令、脚本、常量和数据。服务提供方可将其能力作为接口开放，而隐藏底层实现。以往研究聚焦于直接暴露文件的提示注入攻击，相应防御也以此为目标。然而，阻止文件泄露并不能防止用户通过正常交互恢复其功能。本文提出行为技能重建（BSR）问题：能否在不接触文件的前提下，仅通过合法任务请求和观察响应来复现技能功能？我们提出SkillClone，一种黑盒攻击方法：基于公开广告形成接口假设，发出结构化良性探针，合成可执行副本，并通过与目标技能的差异验证进行迭代修复。在涵盖规则、表格、流程和算法的30个技能上，该方法对保留输入实现了精确或部分复现。迭代重查弥补了单轮重建的遗漏。由于仅使用合法交互，现有以披露防御为核心的策略覆盖有限，更简略的描述也无法提供有效保护。结果表明，仅保证文件保密不足以确保功能保密，防御必须限制日常使用中的累积信息泄露。
原文摘要 · Abstract (English)
Closed source agent skills may encode proprietary instructions, scripts, constants, and data. Providers may offer their capabilities as services while keeping the underlying packages hidden. Prior work focuses on prompt injection attacks that directly disclose these artifacts, and existing defenses accordingly aim to prevent such leakage. However, preventing file disclosure does not prevent users from recovering the functionality those files implement. This raises a fundamental question: can a user reconstruct a skill's functionality through ordinary use while its files remain hidden? We study behavioral skill reconstruction (BSR), in which an attacker uses valid task requests and observed responses to build a functional clone of a hidden skill. We introduce SkillClone, a black-box attack that clones a target skill by forming an interface hypothesis from its public advertisement, issuing structured benign probes, synthesizing an executable replica, and iteratively repairing it through differential validation against the victim skill. Across 30 skills spanning rules, tables, procedures, and algorithms, SkillClone achieves exact or partial recovery on held-out inputs for several targets. Iterative requerying closes gaps missed by single-round reconstruction. Because SkillClone uses only legitimate interactions, disclosure-focused defenses provide limited coverage, and less detailed skill descriptions offer limited protection. These results show that file secrecy alone does not ensure functional secrecy. Defenses must also limit cumulative information leakage from ordinary use.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。