{"id":"https://openalex.org/W7165027124","doi":"https://doi.org/10.48550/arxiv.2606.18198","title":"Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners","display_name":"Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners","publication_year":2026,"publication_date":"2026-06-16","ids":{"openalex":"https://openalex.org/W7165027124","doi":"https://doi.org/10.48550/arxiv.2606.18198"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.18198","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.18198","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.18198","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138758294","display_name":"Xiaojun Jia","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jia, Xiaojun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008060265","display_name":"J G Liao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liao, Jie","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138787096","display_name":"Simeng Qin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qin, Simeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138772451","display_name":"Ke Ma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Ke","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138795232","display_name":"Wenbo Guo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guo, Wenbo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138822023","display_name":"Yebo Feng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Feng, Yebo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138791236","display_name":"Aishan Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Aishan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138822937","display_name":"Yang Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.5027999877929688,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.5027999877929688,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.16290000081062317,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.1589999943971634,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.6495000123977661},{"id":"https://openalex.org/keywords/documentation","display_name":"Documentation","score":0.47269999980926514},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.41909998655319214},{"id":"https://openalex.org/keywords/privilege","display_name":"Privilege (computing)","score":0.40799999237060547},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.3416000008583069},{"id":"https://openalex.org/keywords/interface","display_name":"Interface (matter)","score":0.3312000036239624},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.3102000057697296}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8102999925613403},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.6495000123977661},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.5235999822616577},{"id":"https://openalex.org/C56666940","wikidata":"https://www.wikidata.org/wiki/Q788790","display_name":"Documentation","level":2,"score":0.47269999980926514},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.41909998655319214},{"id":"https://openalex.org/C2780138299","wikidata":"https://www.wikidata.org/wiki/Q3404265","display_name":"Privilege (computing)","level":2,"score":0.40799999237060547},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3605000078678131},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3416000008583069},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.3312000036239624},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.32679998874664307},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.3102000057697296},{"id":"https://openalex.org/C527412718","wikidata":"https://www.wikidata.org/wiki/Q855395","display_name":"Interpretation (philosophy)","level":2,"score":0.30149999260902405},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.29820001125335693},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.28600001335144043},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.27230000495910645},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.25949999690055847},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.25929999351501465},{"id":"https://openalex.org/C2779338814","wikidata":"https://www.wikidata.org/wiki/Q5179285","display_name":"Covert","level":2,"score":0.2526000142097473},{"id":"https://openalex.org/C138673069","wikidata":"https://www.wikidata.org/wiki/Q322229","display_name":"Tracing","level":2,"score":0.2513999938964844}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.18198","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.18198","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.18198","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.18198","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.4784032702445984,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Agent":[0],"skills":[1],"are":[2],"emerging":[3],"as":[4,34,107,189],"an":[5,13,146],"important":[6],"attack":[7,86,115],"surface":[8],"in":[9,60],"LLM-based":[10],"systems.":[11],"Through":[12],"empirical":[14],"study":[15],"of":[16,109,128],"existing":[17,205],"skill":[18,96,164,206,213],"scanners,":[19,207],"we":[20,79,142],"find":[21],"that":[22,87,151,200],"current":[23],"defenses":[24],"primarily":[25],"rely":[26,118],"on":[27,119,124],"textual":[28,129],"descriptions,":[29],"manifests,":[30],"and":[31,131,159,173,184,194],"source":[32],"code":[33],"the":[35,99,110,114,120,125,212],"main":[36],"signals":[37],"for":[38],"security":[39],"analysis,":[40],"which":[41],"can":[42,210],"leave":[43],"visually":[44],"conveyed":[45],"malicious":[46,89,202],"intent":[47,153],"insufficiently":[48],"examined.":[49],"This":[50],"creates":[51],"a":[52,82,95],"practical":[53],"blind":[54],"spot:":[55],"harmful":[56],"operational":[57],"instructions":[58,90,203],"hidden":[59,178],"images":[61,92,106],"may":[62],"bypass":[63],"scanning":[64,149,214],"while":[65,97,208],"still":[66],"being":[67],"recoverable":[68],"by":[69],"multimodal":[70,84,148],"agents":[71],"during":[72],"deployment.":[73],"To":[74,137],"systematically":[75],"investigate":[76],"this":[77],"threat,":[78],"propose":[80,144],"SkillCamo,":[81],"document-mediated":[83],"instruction":[85],"conceals":[88],"within":[91],"bundled":[93],"with":[94],"rewriting":[98],"surrounding":[100],"documentation":[101],"to":[102,176],"naturally":[103],"reference":[104],"those":[105],"part":[108],"normal":[111],"workflow.":[112],"Thus,":[113],"does":[116],"not":[117],"image":[121],"alone,":[122],"but":[123],"joint":[126],"interpretation":[127],"guidance":[130],"visual":[132,174],"payload":[133],"at":[134],"execution":[135,161],"time.":[136],"defend":[138],"against":[139],"such":[140,188],"attacks,":[141],"further":[143],"ExecScan,":[145],"execution-grounded":[147],"module":[150],"performs":[152],"extraction,":[154],"behavior":[155,182],"reconstruction,":[156],"abuse":[157],"assessment,":[158],"deliberative":[160],"simulation":[162],"over":[163],"artifacts.":[165],"ExecScan":[166,209],"jointly":[167],"analyzes":[168],"documentation,":[169],"code,":[170],"referenced":[171],"resources,":[172],"content":[175],"recover":[177],"instructions,":[179],"reconstruct":[180],"executable":[181],"chains,":[183],"identify":[185],"downstream":[186],"risks":[187],"exfiltration,":[190],"destruction,":[191],"persistence,":[192],"deception,":[193],"privilege":[195],"escalation.":[196],"Extensive":[197],"experiments":[198],"show":[199],"image-hidden":[201],"challenge":[204],"improve":[211],"performance.":[215]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-18T00:00:00"}