SEEK: evolutionary knowledge skill extraction against frontier scientific agents

Core question: can deployed scientific agents prevent their private skills from being extracted through user-visible interactions?

• Problem setting: scientific agents encapsulate domain expertise (task decomposition, tool sequences, domain heuristics) as reusable skill files and offer them as paid services; the authors state that this modularity introduces confidentiality risk—the interactions that deliver skill capabilities may also leak the skills themselves. In one routine use, a single reproduction request caused a scientific agent to leak three executable files and 2,768 characters of internal instructions.
• Gaps in existing work: the authors state that prior internal knowledge extraction research mainly targets system prompts, RAG knowledge bases, and agent memory; existing black-box skill stealing work (Black-Box Skill Stealing) targets skills from public sources, and its attack prompts are generated offline by a fixed scenario policy and do not adapt to target responses.
• Core observation: even if skill files are not directly accessible, an agent's user-visible responses may still leak behavioral signatures (execution steps, tool-use rules, domain constraints); a failed query or repeated refusals do not prove that continued probing will not leak more information, and partial leaks can help an attacker progressively recover protected content.
• What the paper proposes: a cross-platform skill confidentiality evaluation framework (including a benchmark of 8 platforms and 40 skills and three attack protocols), and SEEK (Skill Extraction with Evolving Knowledge)—a black-box, self-evolving red-team agent that consolidates evidence from responses into persistent memory and evolves reusable attack skills.
• Threat model (Section 3.3):
  • Goal: extract the protected private prompt/skill text as accurately as possible; if faithful extraction is not possible, secondarily generate a prompt that reproduces its functionality.
  • Knowledge: knows the platform's public identity, documented interfaces, public skill names, and attack protocol; does not know the private prompt text, system/developer instructions, model parameters, hidden defense state, evaluator prompts, or ground-truth labels.
  • Capabilities: within budget B, may submit arbitrary user-level requests, vary wording and format, combine and switch extraction strategies, conduct multi-round interactions, and decide based on history whether to continue or restart the conversation; operates only through public interfaces.
  • Victim system: a scientific agent composed of a language model, an orchestration layer, one or more private prompts/skills, optional external tools, and possible defenses.

Internal knowledge asset extraction

• PLeak (2024) progressively recovers system prompts by optimizing black-box queries; Raccoon (2024) systematizes prompt extraction and compound attacks, evaluating leak risk in defended and undefended settings.
• Subsequent work extends extraction targets to RAG private knowledge bases (2024) and historical interaction records in agent memory (2025); other work exploits model sycophancy in multi-round interactions to elicit task instructions and private knowledge (2024).
• The prompt injection benchmarks InjecAgent (2024) and AgentDojo (2024) target malicious instructions in external content or tool outputs hijacking agent behavior; the paper notes that this is a different threat, and this paper considers only queries issued through the user interface.

Agent skill security

• Agent Skills in the Wild (2026) analyzes public skills at scale, identifying vulnerabilities such as prompt injection, data exfiltration, privilege abuse, and supply-chain attacks; Skill-Inject (2026) embeds malicious instructions in skill files and evaluates the security of agents executing contaminated skills.
• Towards Secure Agent Skills (2026) characterizes structural threats at each stage of skill creation, distribution, deployment, and execution.
• Black-Box Skill Stealing (2026) claims that skills from public sources can be stolen through black-box queries; the paper notes that its attack prompts are generated offline by a fixed scenario policy and do not adapt to target responses. Other work infers skill instructions or reconstructs task capabilities from observable execution traces (2026).

Adaptive attacks

• AutoDAN-Turbo (2025) continuously generates, summarizes, and retrieves jailbreak strategies based on attack history and evaluation results; JustAsk (2026) uses UCB to select among predefined low-level attack skills and high-level interaction patterns for system prompt extraction.
• The paper notes that these methods mainly move from fixed templates to feedback-driven strategies, but their target is jailbreaking or system prompt recovery.

Baselines and benchmark: the paper compares three attack protocols—Direct Probing (DP), Fixed-Strategy Probing (FSP), and Bandit-Guided Iterative Probing (BGIP, following JustAsk's UCB selection)—on a benchmark of 8 platforms and 40 protected skills constructed by the authors.

Positioning of this paper: the authors state that this paper studies the native skills on which scientific agent platforms (including closed-source services) rely to provide expertise, testing whether the platforms' own confidentiality mechanisms can prevent extraction; in addition to evolving strategies, SEEK also accumulates knowledge about specific targets, updating both the attacker's understanding of the target and its probing method each round.

Overall approach: skill extraction is modeled as a budget-constrained, response-conditioned probing process, and SEEK is proposed—persistent memory accumulates target evidence, and skill evolution turns reusable interaction patterns into new attack skills; the two jointly determine the next probe; a platform adapter unifies user-level interaction and budget, and the scoring path is chosen according to the availability of reference text.

Formalization and objective

• Target platform i contains private skill s_i, exposes adapter A_i, and has budget B_i. At round t, SEEK, based on attack history H, memory M at time t-1, skill library K, and remaining budget, outputs action a_t = (u_t, p_t, k_t): session control action, attack prompt, and selected or combined attack skill.
• The attacker only observes user-visible responses y_t = P_vis(τ_t) and feedback permitted by the protocol; hidden reasoning, tool traces, private files, ground truth, leak scores, and final judgments are all outside its observation channel.
• The optimization objective is max_π,U 𝔼_i∼𝒟[max_{1≤ t≤ Bi} Q_i(y_t)], where Q_i is the evaluator-side extraction quality, never provided to the attack policy; meaning: maximize, within budget, the extraction quality of the best single-round response on each target.

Dual evolution loop

• Memory consolidation: when response length reaches threshold L_mem = 80 characters, the extractor identifies three types of candidates—defense (defensive behavior), agree (information proactively disclosed), and abletool (inferable callable capability)—and aligns them with at most r = 3 active memories from the same platform (insert, keep duplicate, merge, or replace).
• Skill generation gating: when cumulative tool calls on the Runner side reach 10, or among the most recent 5 attack prompts there is a request to save memory/skill, gate χ opens; generation is triggered only if the reusability judgment is positive, and new skills enter the library only after validation. Evaluator and generator inputs contain only the most recent 10 visible messages (500 characters each), existing skill names, and source identifiers.
• Context loading: LoadContext prioritizes the currently updated memory, adds at most 3 recent records from the same platform, and loads generated skills matching the platform and target skill, with a budget of 4,000 characters.
• Built-in policy: the attack-v3 policy starts with direct-ask (a single message requesting the full skill name, description, and exact instructions); if the answer is generalized, incomplete, or refused but the response exposes behavioral evidence such as artifacts, procedures, schemas, or errors, it restarts the session and switches to foot-in-the-door, starting from an ordinary request and extracting one observable contract element at a time (internal policy in Table 8; full prompts in Appendix D).

Benchmark classification and attack protocols

• Platforms are divided into open-source/closed-source according to whether evaluators can access the source code; skills are divided into general research capabilities and domain scientific workflows (full list in Table 4, 40 skills and 8 platforms in total).
• Three benchmark protocols: DP single direct request; FSP a fixed four-step prompt combination independent of responses; BGIP updates arm selection using scoring feedback within a fixed policy space. SEEK is evaluated separately. Appendix D gives the exact prompts for each protocol.

Dual-path scoring

• Common success threshold τ = 0.7. Open-source targets use the reference-based leak score S_ref(g,r)=1/3(ROUGE-L+CosSim+LLM-L), i.e., the mean of sequence recovery, semantic similarity, and LLM leak judgment; Purifier first selects verbatim response segments containing target skill content and then recomputes the lexical and embedding terms; reference text is only on the evaluator side.
• Closed-source targets use the reference-free consistency score S_cons: the same attack is repeated in independent sessions, and SelfC is the mean pairwise semantic similarity of final responses; when the target supports confidence follow-up, the average confidence C is used as an online validity gate (when C ≤ 0.6, S_cons = C; when C > 0.6, the mean of SelfC and C is taken; when C is unavailable or SelfC is undefined, it is 0). Validation success is determined only when the confidence gate passes and S_cons ≥ 0.7.

Experimental Setup

• Platforms tested: 8 AI-for-science platforms—open-source ClawBio, OpenScience, EvoScientist, SpatialAgent, Virtual-Lab, and closed-source SciencePal, Biomni, OmicOS; 40 protected skills in total (Table 4).
• Target models: each platform's default model configuration; for open-source platforms that allow a custom provider, DeepSeek-V4-Pro-202606 is used, while proprietary models or platforms that do not allow replacement keep the default model.
• Attack models: all protocols use DeepSeek-V4-Pro-202606; BGIP and SEEK each have a budget of 20 interaction rounds per episode, and SEEK stops early upon reaching a full score of 1.0.
• Metrics: Max (the maximum of all valid scores), Mean (the macro-average of each skill's session maximum), ASR (the proportion of skill episodes reaching the 0.7 threshold), FSR (the average first-success round of successful episodes).
• Scoring: S_ref for open-source and S_cons for closed-source; on Biomni, because SEEK's adaptive queries differ each time, the target-reported confidence C is used as a reference-free score.
• Repetitions: each platform-skill-method episode is run in an independent session; each platform-skill-protocol combination is run once.

Main Results

Table 1: Max/Mean/ASR/FSR for 8 platforms × 3 protocols (open-source rows use S_ref, closed-source rows use S_cons).

Swipe horizontally to read the table

Platform	n	DP ASR	FSP ASR	BGIP ASR	BGIP FSR
ClawBio	6	100.0%	100.0%	100.0%	5.8
OpenScience	6	66.7%	50.0%	83.3%	2.8
EvoScientist	2	100.0%	100.0%	100.0%	2.0
SpatialAgent	6	16.7%	16.7%	100.0%	3.7
Virtual-Lab	2	50.0%	50.0%	50.0%	1.0
SciencePal	6	100.0%	100.0%	100.0%	1.0
Biomni	6	0.0%	0.0%	100.0%	5.7
OmicOS	6	100.0%	100.0%	100.0%	1.0

• The authors state that leakage is widespread: all 8 platforms (100%) leak at least one protected skill, 4 platforms reach 100% ASR under a single direct request, and 7 of the 8 platforms reach at least 83.3% under iterative probing.
• The authors state that closed-source deployment does not mean stronger protection: SciencePal and OmicOS succeed on all 6 skills under every protocol and disclose internal content without refusal in the first round.
• Biomni is the most resistant platform: DP's Max of 0.475 and Mean of 0.129 are the lowest among the 8 platforms, with no successful episodes under DP/FSP, but ASR still reaches 100.0% under BGIP, with the slowest episode using 15 of 20 rounds.

SEEK's Extraction Efficiency (Section 4.4, Table 2)

• What was tested: BGIP and SEEK are compared on 6 skills each on SpatialAgent (open-source) and Biomni (closed-source) (selection rationale in Appendix B.1: both have higher average FSR under BGIP and low success rates under simple protocols).
• Results: ASR is 100.0% for both; the average FSR drops from 3.67 for BGIP to 2.50 for SEEK on SpatialAgent (a 31.8% decrease), and from 5.67 to 3.50 on Biomni (a 38.2% decrease); on both platforms, SEEK reaches the threshold for 5 of 6 skills in the same or an earlier round.
• Authors' interpretation: response-conditioned adaptation improves attack efficiency without reducing skill-level coverage. In the case study (Section 4.5), when SEEK attacks SpatialAgent's spatial_deconvolution skill, memory compresses partial leaks into retrievable observations, and after issuing a consolidation request citing M1, M2, and M3 in round 5, S_ref rises from 0.246 to 1.000; the corresponding BGIP episode first succeeds only in round 8.

Controlled Defense Evaluation (Section 4.7, Table 3)

• What was tested: a minimal, skill-agnostic instruction confidentiality policy (Appendix F) is added to the workspace project instructions of open-source OpenScience, making the agent check candidate responses before output and replace protected content with a fixed refusal; three baseline protocols and SEEK are each tested on 6 skills.
• Results: the defense reduces the Mean of DP/FSP/BGIP/SEEK by 100.0%, 91.5%, 40.5%, and 47.4%, respectively, and ASR to 0.0%, 0.0%, 0.0%, and 16.7%, respectively; SEEK is the only remaining breach, with FSR rising from 1.0 to 11.0, and on the remote-compute skill in round 11 it makes OpenScience reproduce the main body of the protected skill (S_ref = 0.855, with subsequent responses reaching 1.000).
• Authors' interpretation: prompt-level confidentiality policies can block direct, fixed-strategy, and bandit-guided extraction, but are still eroded by attackers that turn early responses into progressively precise reconstruction requests; the defense is an effective baseline but not a complete security boundary.

Validity of Reference-Free Scoring (Section 4.2, Figure 2)

• What was tested: SciencePal and Biomni provide the original skill text through a non-conversational skill management interface; S_cons and S_ref are retrospectively compared on 36 platform-skill-protocol episodes (528 response-level scores, 264 pairs).
• Results: Figure 2(a) shows Pearson r = 0.902 and Spearman ρ = 0.867, with 73 of 84 summaries (86.9%) having consistent threshold classification at τ = 0.7; Figure 2(b) shows a window-level correlation of r = 0.710 between response-level disagreement and reference-score difference.
• Authors' interpretation: these results empirically support S_cons as a reference-free leakage metric on the evaluated platforms.

Other Ablations and Analyses

• Memory and skill evolution ablation (Figure 3, Table 7, SpatialAgent, S_ref): at B = 20, full SEEK has a Mean of 1.000, versus SEEK-base 0.719, SEEK-memory 0.884, and SEEK-skill-evolution 0.858; full SEEK is lower at B ≤ 3 (0.649, 0.707) and surpasses the single-component variants at B = 5 (0.960); each single-component variant fails to extract 1 skill, while full SEEK succeeds on all 6.
• Interface-level defense (Table 5): ClawBio's RoboTerri chat mode has ASR of 0.0% under DP/FSP/BGIP (Mean 0.015, 0.216, and 0.354, respectively), whereas the Claude Code bridge used in the main benchmark has ASR of 100.0% under all three protocols; the authors state that RoboTerri preserves normal task utility.
• Grouped scores (Table 6): aggregated by platform architecture and skill category, BGIP is higher than DP and FSP in all four groups (open-source/closed-source × general/scientific skills) (BGIP ranges 0.931–0.950 across groups).
• Interface leakage: the authors state that the Biomni and SciencePal UIs display the full skill files read during execution, while OmicOS truncates long tool inputs and outputs; this channel is excluded from the formal benchmark.

Limitations noted by the authors and future directions

• SEEK's focused comparison covers only SpatialAgent and Biomni, defenses are evaluated only on OpenScience, and the benchmark scores only final responses rather than heterogeneous trace interfaces (Section 5 Limitations).
• Each platform-skill-protocol combination is run only once, with no run-to-run variance reported (Section 5 Limitations).
• S_cons is validated on only two platforms (SciencePal and Biomni) (Section 5 Limitations).
• All protocols share one attack model (Section 5 Limitations).
• Future work should evaluate targets with stronger defenses, more types of agents, and a larger number of skills (Section 5 Limitations).
• Future evaluations should separately measure response, tool input, tool output, and trace leakage; protecting only chat responses cannot protect the entire user-visible execution surface (Section 5 Discussion).

Scope of experimental coverage

• The platforms tested are 8 scientific agents (5 open-source, 3 closed-source), with 40 protected skills in total (Table 4).
• The benchmark protocols are DP, FSP, and BGIP; SEEK is evaluated separately on SpatialAgent and Biomni (Sections 4.1, 4.4).
• The defense evaluated is an instruction-level confidentiality policy in the OpenScience workspace project instructions, enforced only by agent instructions, with no external output filtering or action-level enforcement (Appendix F); the RoboTerri interface of ClawBio was also evaluated (Table 5).
• The attack model is DeepSeek-V4-Pro-202606 (all protocols); BGIP and SEEK have a budget of 20 rounds per episode; each platform-skill-protocol combination is run once (Section 4.1).
• The paper does not report the specific names of the default models of the target platforms (it only states that DeepSeek-V4-Pro-202606 is used when substitution is allowed, otherwise the default model is retained).

An attack and evaluation paper on the confidentiality of private skills in scientific agents.

• Problem: Scientific agents encapsulate domain expertise as private skills and offer them as paid services, but the user interactions that deliver skill capabilities may leak the skills themselves; the authors ask whether deployed scientific agents can prevent private skills from being extracted through user-visible interactions.
• Method: Build a benchmark covering 8 open-source/closed-source platforms and 40 protected skills, with a unified threat model (authorized user, user-visible responses only, budget-limited), comparing three protocols: DP, FSP, and BGIP; propose SEEK, which uses persistent memory to consolidate response evidence, uses skill evolution to generate reusable attack strategies, and adaptively probes conditioned only on responses; open-source targets are scored with S_ref and closed-source targets with S_cons, with a threshold of 0.7.
• Main results: All 8 platforms (100%) leak at least one skill, and 4 platforms reach 100% ASR under a single direct request (Table 1); Biomni has no successes under DP/FSP but 100% under BGIP.
• SEEK efficiency: SEEK succeeds on all 12 skills on SpatialAgent and Biomni, and the average first-success round is 31.8% lower than BGIP (3.67→2.50) and 38.2% lower (5.67→3.50), respectively (Table 2).
• Defense evaluation: OpenScience's instruction-level confidentiality policy reduces the ASR of all three baseline protocols to 0.0%, but SEEK still extracts 1 of 6 skills with 16.7% ASR (Table 3).
• Authors' conclusion: Current scientific agents cannot reliably protect their skills, and defenses must be evaluated against adaptive, multi-turn attackers; a single refusal or passing a fixed attack test is insufficient to prove confidentiality, and defense evaluation should also cover all user-visible channels such as tool traces.