Presentation overview
This presentation investigates reference-feedback poisoning in text-space skill optimization. It asks whether attacker-controlled reference answers can become supervision for an optimizer-produced Markdown skill, survive promotion gates, and later activate as a persistent backdoor on held-out inputs.
Threat model and evaluation
The target is SkillOpt, where a frozen model is guided by a persistent, editable skill. The study traces the complete promotion chain from recognition and rule proposal through merge, ranking, retention, and held-out activation. Experiments cover SearchQA and SpreadsheetBench while measuring trigger success, clean false activation, rule formation, and the effect of poisoned validation references.
Key findings
The experiments show that poisoned training references can form the malicious rule while validation references influence whether it is promoted. A clean utility-improving edit can carry a validation-neutral backdoor through the selection gate, and paired rule deletion removes activation while preserving clean behavior. The results motivate reference provenance, per-edit validation, and persistent-skill audits as defenses.