{"id":"https://openalex.org/W7201875571","doi":"https://doi.org/10.48550/arxiv.2608.05563","title":"When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems","display_name":"When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems","publication_year":2026,"publication_date":"2026-08-06","ids":{"openalex":"https://openalex.org/W7201875571","doi":"https://doi.org/10.48550/arxiv.2608.05563"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.05563","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.05563","pdf_url":"https://arxiv.org/pdf/2608.05563","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.05563","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5144214532","display_name":"Jialuo Chen","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4405270328","display_name":"Ant Group (China)","ror":"https://ror.org/00g5w7n47","country_code":"CN","type":"company","lineage":["https://openalex.org/I4405270328"]},{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chen, Jialuo","raw_affiliation_strings":["Ant Group","Zhejiang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ant Group","institution_ids":["https://openalex.org/I4405270328"]},{"raw_affiliation_string":"Zhejiang University","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108578565","display_name":"Lingqi Jiang","orcid":"https://orcid.org/0009-0001-0856-7891","observed_orcids":["https://orcid.org/0009-0001-0856-7891"]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiang, Lingqi","raw_affiliation_strings":["Zhejiang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121054302","display_name":"Xinhao Deng","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4405270328","display_name":"Ant Group (China)","ror":"https://ror.org/00g5w7n47","country_code":"CN","type":"company","lineage":["https://openalex.org/I4405270328"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Deng, Xinhao","raw_affiliation_strings":["Ant Group","Tsinghua University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ant Group","institution_ids":["https://openalex.org/I4405270328"]},{"raw_affiliation_string":"Tsinghua University","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067405541","display_name":"Xiaohu Du","orcid":"https://orcid.org/0000-0003-4455-3128","observed_orcids":["https://orcid.org/0000-0003-4455-3128"]},"institutions":[{"id":"https://openalex.org/I4405270328","display_name":"Ant Group (China)","ror":"https://ror.org/00g5w7n47","country_code":"CN","type":"company","lineage":["https://openalex.org/I4405270328"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Du, Xiaohu","raw_affiliation_strings":["Ant Group"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ant Group","institution_ids":["https://openalex.org/I4405270328"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101852566","display_name":"Jianan Ma","orcid":"https://orcid.org/0009-0007-0448-1218","observed_orcids":["https://orcid.org/0009-0007-0448-1218"]},"institutions":[{"id":"https://openalex.org/I4405270328","display_name":"Ant Group (China)","ror":"https://ror.org/00g5w7n47","country_code":"CN","type":"company","lineage":["https://openalex.org/I4405270328"]},{"id":"https://openalex.org/I50760025","display_name":"Hangzhou Dianzi University","ror":"https://ror.org/0576gt767","country_code":"CN","type":"education","lineage":["https://openalex.org/I50760025"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ma, Jianan","raw_affiliation_strings":["Ant Group","Hangzhou Dianzi University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ant Group","institution_ids":["https://openalex.org/I4405270328"]},{"raw_affiliation_string":"Hangzhou Dianzi University","institution_ids":["https://openalex.org/I50760025"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103258005","display_name":"Yunhao Feng","orcid":"https://orcid.org/0009-0002-9227-9717","observed_orcids":["https://orcid.org/0009-0002-9227-9717","https://orcid.org/0009-0005-3042-5266"]},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Feng, Yunhao","raw_affiliation_strings":["National University of Defense Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Defense Technology","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112999768","display_name":"Yuqi Qing","orcid":"https://orcid.org/0009-0005-4226-9387","observed_orcids":["https://orcid.org/0009-0005-4226-9387"]},"institutions":[{"id":"https://openalex.org/I4405270328","display_name":"Ant Group (China)","ror":"https://ror.org/00g5w7n47","country_code":"CN","type":"company","lineage":["https://openalex.org/I4405270328"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qing, Yuqi","raw_affiliation_strings":["Ant Group","Tsinghua University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ant Group","institution_ids":["https://openalex.org/I4405270328"]},{"raw_affiliation_string":"Tsinghua University","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5146024694","display_name":"Zhihao Yuan","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210116924","display_name":"Chinese University of Hong Kong, Shenzhen","ror":"https://ror.org/02d5ks197","country_code":"CN","type":"education","lineage":["https://openalex.org/I177725633","https://openalex.org/I180726961","https://openalex.org/I4210116924"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuan, Zhihao","raw_affiliation_strings":["The Chinese University of Hong Kong , Shenzhen"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The Chinese University of Hong Kong , Shenzhen","institution_ids":["https://openalex.org/I4210116924"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136270109","display_name":"Linkang Du","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Du, Linkang","raw_affiliation_strings":["Xi'an Jiaotong University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Xi'an Jiaotong University","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5146034106","display_name":"Jingyi Wang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wang, Jingyi","raw_affiliation_strings":["Zhejiang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University","institution_ids":["https://openalex.org/I76130692"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":7,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":6,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.00139999995008111,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-attacks","display_name":"adversarial attacks","score":0.5270000100135803},{"id":"https://openalex.org/keywords/black-box-attacks","display_name":"black-box attacks","score":0.5320000052452087},{"id":"https://openalex.org/keywords/agent-security","display_name":"agent security","score":0.3540000021457672}],"concepts":[{"id":"https://openalex.org/C2779010991","wikidata":"https://www.wikidata.org/wiki/Q2720909","display_name":"Artifact (error)","level":2,"score":0.7124999761581421},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5577999949455261},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4927999973297119},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.44269999861717224},{"id":"https://openalex.org/C180747234","wikidata":"https://www.wikidata.org/wiki/Q23373","display_name":"Cognitive psychology","level":1,"score":0.428600013256073},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.41510000824928284},{"id":"https://openalex.org/C98147612","wikidata":"https://www.wikidata.org/wiki/Q215599","display_name":"Promotion (chess)","level":3,"score":0.4074999988079071},{"id":"https://openalex.org/C13662910","wikidata":"https://www.wikidata.org/wiki/Q193139","display_name":"Trajectory","level":2,"score":0.4016999900341034},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3797999918460846},{"id":"https://openalex.org/C143299363","wikidata":"https://www.wikidata.org/wiki/Q900584","display_name":"Attribution","level":2,"score":0.35109999775886536},{"id":"https://openalex.org/C62354387","wikidata":"https://www.wikidata.org/wiki/Q875399","display_name":"Boundary (topology)","level":2,"score":0.34529998898506165},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.3319000005722046},{"id":"https://openalex.org/C2779795794","wikidata":"https://www.wikidata.org/wiki/Q7315343","display_name":"Reset (finance)","level":2,"score":0.3167000114917755},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.3158000111579895},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.290800005197525},{"id":"https://openalex.org/C2777617010","wikidata":"https://www.wikidata.org/wiki/Q18957","display_name":"Mainstream","level":2,"score":0.2809999883174896},{"id":"https://openalex.org/C108650721","wikidata":"https://www.wikidata.org/wiki/Q1783253","display_name":"Counterfactual thinking","level":2,"score":0.2632000148296356},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.26249998807907104},{"id":"https://openalex.org/C79897977","wikidata":"https://www.wikidata.org/wiki/Q5054568","display_name":"Causal chain","level":2,"score":0.2596000134944916},{"id":"https://openalex.org/C34388435","wikidata":"https://www.wikidata.org/wiki/Q2267362","display_name":"Bounded function","level":2,"score":0.2574999928474426}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.05563","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.05563","pdf_url":"https://arxiv.org/pdf/2608.05563","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.05563","doi":"https://doi.org/10.48550/arxiv.2608.05563","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.05563","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.05563","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.05563","pdf_url":"https://arxiv.org/pdf/2608.05563","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7201875571.pdf","grobid_xml":"https://content.openalex.org/works/W7201875571.grobid-xml"},"referenced_works_count":19,"referenced_works":["https://openalex.org/W4395064792","https://openalex.org/W4416549384","https://openalex.org/W6891874193","https://openalex.org/W7127393332","https://openalex.org/W7128545450","https://openalex.org/W7129059528","https://openalex.org/W7131420072","https://openalex.org/W7133311975","https://openalex.org/W7141388408","https://openalex.org/W7148785316","https://openalex.org/W7150989032","https://openalex.org/W7151060071","https://openalex.org/W7153319489","https://openalex.org/W7154068740","https://openalex.org/W7154299763","https://openalex.org/W7157154595","https://openalex.org/W7160304775","https://openalex.org/W7162490112","https://openalex.org/W7164000790"],"related_works":["https://openalex.org/W7172531637","https://openalex.org/W7202204785","https://openalex.org/W7204606909","https://openalex.org/W7204927963","https://openalex.org/W7220988507","https://openalex.org/W7203492321","https://openalex.org/W7201834752","https://openalex.org/W7172413134","https://openalex.org/W7163202500","https://openalex.org/W7222354347"],"abstract_inverted_index":{"Self-evolving":[0],"skill":[1,35,51],"(SES)":[2],"systems":[3],"distill":[4],"agent":[5],"trajectories":[6],"into":[7],"persistent":[8],"skills,":[9],"allowing":[10],"untrusted":[11],"experience":[12],"to":[13],"become":[14],"trusted":[15],"instruction.":[16],"We":[17,78],"introduce":[18],"PoisonedEvolution,":[19],"a":[20,33,133,143,147,174],"trajectory-poisoning":[21],"attack":[22],"on":[23],"this":[24],"promotion":[25,172],"process.":[26],"Our":[27],"skill-visible":[28],"black-box":[29],"attacker":[30,90,139],"can":[31],"inspect":[32],"target":[34,67,101,120],"and":[36,59,74,159],"contribute":[37],"bounded":[38],"evidence,":[39],"but":[40],"cannot":[41],"observe":[42],"private":[43],"pools":[44],"or":[45,48],"evolution":[46,130],"logic":[47],"edit":[49],"the":[50,63,66,109,115,163],"bank.":[52],"Artifact":[53],"poisoning":[54],"requires":[55],"Inclusion,":[56],"Evolution":[57],"Attribution,":[58],"Realization.":[60],"Attribution":[61],"is":[62,150],"distinctive":[64],"bottleneck:":[65],"behavior":[68],"must":[69],"appear":[70],"causally":[71],"useful,":[72],"recurrent,":[73],"generalizable":[75],"before":[76],"promotion.":[77],"evaluate":[79],"four":[80],"representative":[81,134],"security-effect":[82],"families":[83],"using":[84],"inert":[85],"canary":[86],"specifications.":[87],"At":[88],"10%":[89],"support,":[91,156],"across":[92,129],"six":[93],"mainstream":[94],"LLM":[95],"evolvers":[96],"in":[97,103,122,142],"SkillClaw,":[98],"PoisonedEvolution":[99],"embeds":[100,119],"behaviors":[102,121],"546/600":[104],"trials":[105,124],"(91.0%":[106],"SER).":[107],"On":[108],"structurally":[110],"different":[111],"Trace2Skill":[112],"pipeline":[113],"at":[114],"same":[116],"ratio,":[117],"it":[118],"369/600":[123],"(61.5%":[125],"SER),":[126],"demonstrating":[127],"transfer":[128],"architectures.":[131],"In":[132],"controlled":[135],"study,":[136],"three":[137],"consistent":[138],"records":[140],"suffice":[141],"30-record":[144],"batch,":[145],"whereas":[146],"single":[148],"record":[149],"much":[151],"weaker.":[152],"Ablations":[153],"identify":[154],"recurring":[155],"causal":[157],"framing,":[158],"domain-aligned":[160],"encoding":[161],"as":[162,173],"main":[164],"determinants":[165],"of":[166],"success.":[167],"These":[168],"findings":[169],"expose":[170],"evidence":[171],"security":[175],"boundary":[176],"for":[177],"self-evolving":[178],"agents.":[179]},"counts_by_year":[{"year":2026,"cited_by_count":6}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-08-08T00:00:00"}