{"id":"https://openalex.org/W7155533524","doi":"https://doi.org/10.48550/arxiv.2604.21829","title":"Black-Box Skill Stealing Attack from Proprietary LLM Agents: An Empirical Study","display_name":"Black-Box Skill Stealing Attack from Proprietary LLM Agents: An Empirical Study","publication_year":2026,"publication_date":"2026-04-23","ids":{"openalex":"https://openalex.org/W7155533524","doi":"https://doi.org/10.48550/arxiv.2604.21829"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.21829","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.21829","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.21829","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134508322","display_name":"Zihan Wang","orcid":"https://orcid.org/0009-0008-2979-5253"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Zihan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134506924","display_name":"Rui Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Rui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134555878","display_name":"Yu Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134512143","display_name":"Chi Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Chi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134543714","display_name":"Qingchuan Zhao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhao, Qingchuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134565146","display_name":"Hongwei Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Hongwei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5134483353","display_name":"Guowen Xu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Guowen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.4332999885082245,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.4332999885082245,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.0771000012755394,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.04820000007748604,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.7376000285148621},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5012999773025513},{"id":"https://openalex.org/keywords/empirical-research","display_name":"Empirical research","score":0.4943000078201294},{"id":"https://openalex.org/keywords/rationalization","display_name":"Rationalization (economics)","score":0.45739999413490295},{"id":"https://openalex.org/keywords/quality","display_name":"Quality (philosophy)","score":0.43860000371932983},{"id":"https://openalex.org/keywords/empirical-evidence","display_name":"Empirical evidence","score":0.40720000863075256},{"id":"https://openalex.org/keywords/compromise","display_name":"Compromise","score":0.3650999963283539}],"concepts":[{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.7376000285148621},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5703999996185303},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5342000126838684},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5012999773025513},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.4943000078201294},{"id":"https://openalex.org/C52438962","wikidata":"https://www.wikidata.org/wiki/Q1555139","display_name":"Rationalization (economics)","level":2,"score":0.45739999413490295},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.43860000371932983},{"id":"https://openalex.org/C166052673","wikidata":"https://www.wikidata.org/wiki/Q83021","display_name":"Empirical evidence","level":2,"score":0.40720000863075256},{"id":"https://openalex.org/C46355384","wikidata":"https://www.wikidata.org/wiki/Q726686","display_name":"Compromise","level":2,"score":0.3650999963283539},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.3172999918460846},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.31310001015663147},{"id":"https://openalex.org/C74072328","wikidata":"https://www.wikidata.org/wiki/Q1142726","display_name":"Intelligent agent","level":2,"score":0.31209999322891235},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3102000057697296},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.28619998693466187},{"id":"https://openalex.org/C2780873155","wikidata":"https://www.wikidata.org/wiki/Q392811","display_name":"Agent-based model","level":2,"score":0.28200000524520874},{"id":"https://openalex.org/C5894958","wikidata":"https://www.wikidata.org/wiki/Q2297769","display_name":"Software agent","level":2,"score":0.2809000015258789},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.2718999981880188},{"id":"https://openalex.org/C41458344","wikidata":"https://www.wikidata.org/wiki/Q732577","display_name":"Publication","level":2,"score":0.27129998803138733},{"id":"https://openalex.org/C100521375","wikidata":"https://www.wikidata.org/wiki/Q2015382","display_name":"Competence (human resources)","level":2,"score":0.25119999051094055}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.21829","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.21829","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.21829","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.21829","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Quality Education","score":0.6117777228355408,"id":"https://metadata.un.org/sdg/4"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"language":[1],"model":[2],"(LLM)":[3],"agents":[4],"increasingly":[5],"rely":[6],"on":[7,197],"skills":[8,19,174],"to":[9,57,222],"package":[10],"reusable":[11],"capabilities":[12],"through":[13,35,137],"instructions,":[14],"tools,":[15],"and":[16,25,38,87,99,120,140,166,200,213,215],"resources.":[17],"High-quality":[18],"embed":[20],"expert":[21],"knowledge,":[22],"curated":[23],"workflows,":[24],"execution":[26],"constraints":[27],"into":[28],"agents,":[29],"fueling":[30],"a":[31,45,150,181,216],"growing":[32],"skill":[33,61,71,83],"economy":[34],"their":[36],"value":[37],"scalability.":[39],"Yet":[40],"this":[41,109,187],"ecosystem":[42],"also":[43],"creates":[44],"new":[46],"attack":[47,114,210],"surface,":[48],"as":[49],"adversaries":[50],"can":[51,175],"interact":[52],"with":[53,78],"public":[54],"agent":[55,75,156,164,173,194,240],"interfaces":[56],"extract":[58],"hidden":[59],"proprietary":[60,155,239],"content.":[62],"We":[63,158],"present":[64],"the":[65,102,133,193,209,224],"first":[66],"systematic":[67],"study":[68,108],"of":[69],"black-box":[70],"stealing":[72,84,124],"against":[73],"LLM":[74],"systems.":[76,157],"Compared":[77],"conventional":[79],"system":[80],"prompt":[81,125],"stealing,":[82],"targets":[85],"modular":[86],"structured":[88],"capability":[89],"packages":[90],"whose":[91],"leakage":[92],"is":[93,220],"directly":[94],"actionable":[95],"for":[96,153],"copying,":[97],"redistribution,":[98],"monetization,":[100],"making":[101],"resulting":[103],"harm":[104],"potentially":[105],"greater.":[106],"To":[107,185],"threat,":[110,188],"we":[111,189],"derive":[112],"an":[113,122],"taxonomy":[115],"from":[116,129],"prior":[117],"prompt-stealing":[118],"methods":[119],"build":[121],"automated":[123],"generation":[126],"agent.":[127],"Starting":[128],"model-generated":[130],"seed":[131],"prompts,":[132],"framework":[134],"expands":[135],"attacks":[136,161],"scenario":[138],"rationalization":[139],"structure":[141],"injection":[142],"while":[143],"enforcing":[144],"diversity":[145],"via":[146],"embedding-based":[147],"filtering,":[148],"yielding":[149],"reproducible":[151],"pipeline":[152],"evaluating":[154],"evaluate":[159],"these":[160,204,232],"across":[162,192,238],"commercial":[163],"platforms":[165],"representative":[167],"LLMs.":[168],"Our":[169],"results":[170],"show":[171],"that":[172,231],"often":[176],"be":[177],"extracted":[178],"easily,":[179],"posing":[180],"serious":[182],"copyright":[183,233],"risk.":[184],"mitigate":[186],"design":[190],"defenses":[191,205],"pipeline,":[195],"focusing":[196],"input,":[198],"inference,":[199],"output":[201],"phase.":[202],"Although":[203],"substantially":[206],"reduce":[207],"leakage,":[208],"remains":[211],"inexpensive":[212],"repeatable,":[214],"single":[217],"successful":[218],"attempt":[219],"sufficient":[221],"compromise":[223],"protected":[225],"skill.":[226],"Overall,":[227],"our":[228],"findings":[229],"suggest":[230],"risks":[234],"remain":[235],"largely":[236],"overlooked":[237],"ecosystems,":[241],"motivating":[242],"stronger":[243],"protection":[244],"mechanisms.":[245]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-25T00:00:00"}