Surviving the Router: Optimizing Skill Injections for Retrieval and Execution
Router selection sharply lowers the real attack rate for malicious agent skills.
The paper says existing skill-injection tests can overstate success because they often assume the bad skill has already been chosen. In multi-skill settings, those injections first have to survive retrieval, cutting effective attack success by 87-97%. The authors introduce CORSA, which optimizes attacks for both router retrieval and execution across related task clusters. They report higher retrieval and end-to-end success while preserving user utility, with transfer across router architectures and LLM backbones. ArXiv · AI/CL/LG's note
The paper says existing skill-injection tests can overstate success because they often assume the bad skill has already been chosen. In multi-skill settings, those injections first have to survive retrieval, cutting effective attack success by 87-97%. The authors introduce CORSA, which optimizes attacks for both router retrieval and execution across related task clusters. They report higher retrieval and end-to-end success while preserving user utility, with transfer across router architectures and LLM backbones. ArXiv · AI/CL/LG's note
score 5