When Feedback Becomes a Backdoor

An empirical study of how poisoned reference answers can shape optimizer-generated skills and create persistent, selectively activated agent backdoors.

September 5, 2026
# AI Security# Self-Evolving Agents# Backdoors# Skill Optimization
1 /
Loading presentation…

Presentation overview

This presentation investigates reference-feedback poisoning in text-space skill optimization. It asks whether attacker-controlled reference answers can become supervision for an optimizer-produced Markdown skill, survive promotion gates, and later activate as a persistent backdoor on held-out inputs.

Threat model and evaluation

The target is SkillOpt, where a frozen model is guided by a persistent, editable skill. The study traces the complete promotion chain from recognition and rule proposal through merge, ranking, retention, and held-out activation. Experiments cover SearchQA and SpreadsheetBench while measuring trigger success, clean false activation, rule formation, and the effect of poisoned validation references.

Key findings

The experiments show that poisoned training references can form the malicious rule while validation references influence whether it is promoted. A clean utility-improving edit can carry a validation-neutral backdoor through the selection gate, and paired rule deletion removes activation while preserving clean behavior. The results motivate reference provenance, per-edit validation, and persistent-skill audits as defenses.