---
title: "LatentTriad: Pre-Action Risk Representations for Malicious Agent Skill Detection"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2611.05088v1"
permalink: "https://feed.astralor.com/items/itm_01cd826c4d5c820f36b41096"
published: "2026-11-03T15:46:12.000Z"
score: 58
channel: "tech"
tags: ["LLM","AI Agent","LatentTriad","Pre-Action Risk Representations","Malicious Agent Skill","Detection Large","Detecting","Large"]
---

# LatentTriad: Pre-Action Risk Representations for Malicious Agent Skill Detection

## 速览

Large language model agents are increasingly extended with reusable skills, but untrusted skill content can induce operations outside the user's task. Detecting this contextual risk requires more than suspicious-pattern…

## 关键点

- Large language model agents are increasingly extended with reusable skills, but untrusted skill content can induce operations outside the user's task.
- Detecting this contextual risk requires more than suspicious-pattern matching, while dynamic analysis incurs the cost of skill execution.
- We find that hidden states formed during prefill contain readable information about task-operation consistency, including across held-out expression forms in controlled evaluations.

## 全文

Large language model agents are increasingly extended with reusable skills, but untrusted skill content can induce operations outside the user's task. Detecting this contextual risk requires more than suspicious-pattern matching, while dynamic analysis incurs the cost of skill execution. We find that hidden states formed during prefill contain readable information about task-operation consistency, including across held-out expression forms in controlled evaluations. Matched Operation-state interventions also affect later Boundary states and shift fixed risk readouts toward the donor label. Based on these findings, we introduce LatentTriad, which combines contextual Boundary features, group-adjusted Operation directions, and departures from benign state relationships. All branches share one prefill: detection generates no output tokens, invokes no tools, and executes no skill code. Across 5,830 skill packages from five sources and seven backbones, LatentTriad achieves 99.0-99.2% pooled F1 and 93.0-94.6% source-macro F1. A separately measured compact implementation completes prefill and detection in a median of 259-284 ms. These results connect pre-action risk readability and functional influence to execution-free skill screening.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_01cd826c4d5c820f36b41096