Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills

Peichun Hua; Haoxuan Xu; Mengyuan Li

arXiv preprint · 2026

Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills

Peichun Hua, Haoxuan Xu, Mengyuan Li

Read paper (PDF) arXiv record arXiv PDF

Overview

Behavioral skill reconstruction asks whether ordinary interactions with an LLM agent can reveal the functionality of a hidden skill even when its instructions, scripts, and files remain undisclosed. The paper introduces SKILLCLONE to study this threat.

Method

SKILLCLONE forms an interface hypothesis from the public skill description, issues valid task requests, synthesizes an executable replica, and repairs it through differential validation against the target. Evaluation separates functionality contributed by a skill from capabilities already present in the base model.

SKILLCLONE workflow from a public skill interface through hypotheses, adaptive probes and typed observations to clone synthesis and differential validation. — SKILLCLONE reconstructs behavior through valid task probes, executable synthesis, and differential validation. Figure 1 in the paper

Evaluation

The evaluation covers 30 skills spanning rules, tables, procedures, and algorithms. Several targets permit exact or partial recovery on held-out inputs, and iterative requerying closes gaps left by a single reconstruction round. The experiments show limited coverage from defenses focused only on direct file disclosure.

Behavioral reconstruction by dominant skill component
Component type	Skills	Median ASR	Skills above floor
Threshold / decision rules	4	71%	3 / 4
Lookup tables / data	6	84%	6 / 6
Rule composition	6	88%	6 / 6
Procedures / algorithms	8	75%	4 / 8
Numeric formulas	6	57%	4 / 6

Pooled across five victim models, combining controlled mined-skill and deployed SkillsBench settings under the cross-victim protocol. ASR is the paper’s behavioral reconstruction success measure on held-out tasks. “Above floor” reports the source table’s count of skills exceeding their baseline floor. Table 1 in the paper

agent skills
functional cloning
black-box reconstruction
LLM agents
intellectual property
information leakage

Citation

@misc{hua2026skillclone,
      title={Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills}, 
      author={Peichun Hua and Haoxuan Xu and Mengyuan Li},
      year={2026},
      eprint={2608.04192},
      archivePrefix={arXiv},
      primaryClass={cs.CR},
      url={https://arxiv.org/abs/2608.04192}, 
}