SkillWatermark: An Embedded Skill Watermark of Progressive Privacy Inference via Benign Prompts
2026-08-17 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors show that skills used by large language models (LLMs) create unique network traffic patterns when running. They designed a method to hide secret signals, called skill watermarks, inside these skills without stealing data or acting maliciously. These watermarks cause predictable changes in traffic, which an attacker can later read to recover hidden information. Their experiments found these signals are consistent and bypass current security checks. This work points out a new way attackers could exploit network traffic patterns and suggests areas to improve security.
Large Language ModelsLLM AgentsNetwork Traffic PatternsCovert ChannelSkill WatermarksPrompt EngineeringInformation EncodingSecurity AuditingMulti-turn ConversationsData Exfiltration
Authors
Yu Li, Liqi Zhuang, Dong Wei, Jiwen Luo, Hang Zhang, Meng Zhang, Xiaona Li, Weiqing Huang
Abstract
Skills for large language model (LLM) agents have been widely deployed across diverse application domains. However, we observe that these skills generate specific traffic patterns during execution. In this paper, we design a pipeline that generates specific traffic patterns by inserting carefully designed skill descriptions, which we term skill watermarks, so that a passive network attacker can establish a covert channel to encode private information within observable traffic across multiple conversation turns. Specifically, we insert prompt constraint terms, referred to as watermarks, into the original skill descriptions and embed them within multi-turn conversations. The key information in the user's original prompt is thereby triggered by these watermarks, producing clearly observable encodings in the traffic. The adversary need only decode the traffic patterns to recover the encoded information. In particular, our modifications are benign in the sense that they do not directly exfiltrate any private data and do not execute any malicious instructions. Extensive experiments demonstrate that our watermarks produce highly consistent and distinguishable traffic patterns, and that the transformed skills pass existing LLM-based security auditing tools. This study highlights that generating specific traffic patterns can be exploited as a novel attack surface and offers critical insights for future security hardening.