恶意技能可让代码大模型代理多消耗10倍以上计算资源。
SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents
- 通过注入恶意技能，诱导代理执行冗余代码生成
- 实测使代理耗 token 数提升5.4至10.1倍
- 适合关注AI代理安全与资源滥用的开发者
代理技能为代码生成代理提供特定任务指令、脚本和资源，但也形成可信指令通道，可能被滥用于超出传统安全攻击的资源滥用。本文研究通过技能注入引发的令牌放大问题：一种经济资源滥用威胁，即恶意技能导致代理消耗远超正常任务所需的令牌。我们提出 SkillBloat 两阶段框架：第一阶段在多个放大机制下筛选多样攻击条件；第二阶段通过大模型引导的完整技能重写优化最强候选。在真实世界技能基准上评估，SkillBloat 在多种代码代理配置下实现平均最佳放大倍数 5.4184 至 10.1455 倍。消融实验表明，第二阶段迭代优化持续提升放大效果，优于仅依赖第一阶段攻击类型筛选。结果表明，技能生态暴露了与现有技能投毒不同的实际资源放大攻击面。
原文摘要 · Abstract (English)
Agent skills extend coding agents with task-specific instructions, scripts, and resources, but they also create a trusted instruction channel that can be abused beyond conventional security attacks. This paper studies token amplification through skill injection: an economic resource-abuse threat in which a malicious skill causes an agent to consume substantially more tokens than needed for normal task execution. We present SkillBloat, a two-phase framework that first screens a library of diverse attack-type conditions across multiple amplification mechanisms and then refines the strongest candidate through LLM-guided full-document skill rewriting. Evaluated on a real-world skill benchmark, SkillBloat achieves 5.4184x-10.1455x average best amplification across multiple coding-agent target configurations. An ablation shows that the second-stage refinement loop consistently improves average best amplification over Phase 1 attack-type screening alone, demonstrating that iterative optimization provides additional benefit beyond initial attack-type selection. These results show that skill ecosystems expose a practical resource-amplification attack surface that is orthogonal to existing security-oriented skill poisoning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。