{"id":"4377b49938e3292656134e9a8ec6c186212bb661370f95a7d5a2ee88f4e90b53","title":"arXiv cs.AI paper traces how poisoned answers shape Skills","argument":"The authors of “When Feedback Becomes a Backdoor” study whether poisoned reference answers can shape Skills: reusable text artifacts that guide future agent behavior. They report that an attacker can induce a persistent trigger-conditioned rule without access to the model, optimizer, or Skill file. In SearchQA, where the payload replaces a short answer, the natural attack retained an exact rule in all three seeds; the final Skill emitted it on every triggered question and none of the clean questions. In SpreadsheetBench, where the payload required a workbook edit, no natural run retained an exact rule across three seeds. The authors’ diagnostic interventions locate two bottlenecks there: the Analyst abstracts away required literals, and edit-budget ranking can remove exact edits before candidate construction. Their results distinguish exposure to poisoned feedback from a backdoor actually forming and persisting: exposure alone does not ensure the rule is formed, selected, and retained. The different benchmark outcomes leave open what makes a poisoned rule survive when its payload requires more than replacing a short answer.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The findings described here concern SearchQA and SpreadsheetBench; the abstract does not establish how the results extend to other tasks. The reported comparison of clean accuracy to benign SkillOpt is for seed 42 only. The source describes three seeds for the natural attacks, but the abstract does not give further detail on experimental variability.","speaker":{"name":"Koh, Louise Nayeong, Lee, Yaechan, Lee, Myeongjong, Kim, Doyeon, Park, Juyoung, Kim, Seunggyu, Kim, Inseo, Jung, Chaerin, Ryu, Hyogon","roleAtSource":"Article author"},"source":{"title":"When Feedback Becomes a Backdoor: Tracing Backdoor Skill Formation in Text-Space Skill Optimization","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.09348","publishedAt":"2026-11-06","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors describe Skills as reusable text artifacts that guide future agent behavior, and study poisoning reference answers used as supervision in text-space Skill optimization.","excerpt":"Reference answers are a supervision channel in text-space Skill optimization, which produces reusable text artifacts called Skills that guide future agent behavior.","url":"https://arxiv.org/abs/2611.09348","relationship":"Source-stated"},{"text":"The authors report that poisoned answers can induce a persistent trigger-conditioned rule without attacker access to the model, optimizer, or Skill file.","excerpt":"Poisoning those answers can induce a persistent trigger-conditioned rule without giving the attacker access to the model, optimizer, or Skill file.","url":"https://arxiv.org/abs/2611.09348","relationship":"Source-stated"},{"text":"In SearchQA, the natural attack retained an exact rule in all three seeds; each final Skill emitted the payload on all triggered questions and none of the clean questions.","excerpt":"the natural attack retains an exact rule in all three seeds; each final Skill emits the payload on 200/200 triggered questions and 0/200 clean questions.","url":"https://arxiv.org/abs/2611.09348","relationship":"Source-stated"},{"text":"In SpreadsheetBench, no natural run retained an exact rule across three seeds; diagnostic interventions identify abstraction of required literals and edit-budget ranking as successive bottlenecks.","excerpt":"In SpreadsheetBench, where the payload requires an additional workbook edit, no natural run retains an exact rule across three seeds. Diagnostic interventions locate two successive bottlenecks","url":"https://arxiv.org/abs/2611.09348","relationship":"Source-stated"},{"text":"The authors conclude that poisoned references do not guarantee a backdoor rule will form, be selected, and persist.","excerpt":"Poisoned references can therefore create persistent backdoors, but exposure alone does not ensure that the induced rule is formed, selected, and retained.","url":"https://arxiv.org/abs/2611.09348","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.09348","checkedAt":"2026-11-12T21:48:08.449Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"What makes a poisoned rule survive SkillOpt when its payload requires more than replacing a short answer?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI paper traces how poisoned answers shape Skills","summary":"The authors of “When Feedback Becomes a Backdoor” study whether poisoned reference answers can shape Skills: reusable text artifacts that guide future agent behavior. They report that an attacker can induce a persistent trigger-conditioned rule without access to the model, optimizer, or Skill file. In SearchQA, where the payload replaces a short answer, the natural attack retained an exact rule in all three seeds; the final Skill emitted it on every triggered question and none of the clean questions. In SpreadsheetBench, where the payload required a workbook edit, no natural run retained an exact rule across three seeds. The authors’ diagnostic interventions locate two bottlenecks there: the Analyst abstracts away required literals, and edit-budget ranking can remove exact edits before candidate construction. Their results distinguish exposure to poisoned feedback from a backdoor actually forming and persisting: exposure alone does not ensure the rule is formed, selected, and retained. The different benchmark outcomes leave open what makes a poisoned rule survive when its payload requires more than replacing a short answer.","question":"What makes a poisoned rule survive SkillOpt when its payload requires more than replacing a short answer?","claims":[{"text":"The authors describe Skills as reusable text artifacts that guide future agent behavior, and study poisoning reference answers used as supervision in text-space Skill optimization.","excerpt":"Reference answers are a supervision channel in text-space Skill optimization, which produces reusable text artifacts called Skills that guide future agent behavior.","support":"source-stated"},{"text":"The authors report that poisoned answers can induce a persistent trigger-conditioned rule without attacker access to the model, optimizer, or Skill file.","excerpt":"Poisoning those answers can induce a persistent trigger-conditioned rule without giving the attacker access to the model, optimizer, or Skill file.","support":"source-stated"},{"text":"In SearchQA, the natural attack retained an exact rule in all three seeds; each final Skill emitted the payload on all triggered questions and none of the clean questions.","excerpt":"the natural attack retains an exact rule in all three seeds; each final Skill emits the payload on 200/200 triggered questions and 0/200 clean questions.","support":"source-stated"},{"text":"In SpreadsheetBench, no natural run retained an exact rule across three seeds; diagnostic interventions identify abstraction of required literals and edit-budget ranking as successive bottlenecks.","excerpt":"In SpreadsheetBench, where the payload requires an additional workbook edit, no natural run retains an exact rule across three seeds. Diagnostic interventions locate two successive bottlenecks","support":"source-stated"},{"text":"The authors conclude that poisoned references do not guarantee a backdoor rule will form, be selected, and persist.","excerpt":"Poisoned references can therefore create persistent backdoors, but exposure alone does not ensure that the induced rule is formed, selected, and retained.","support":"source-stated"}],"limitations":["The findings described here concern SearchQA and SpreadsheetBench; the abstract does not establish how the results extend to other tasks.","The reported comparison of clean accuracy to benign SkillOpt is for seed 42 only.","The source describes three seeds for the natural attacks, but the abstract does not give further detail on experimental variability."],"mediaId":"abcc2ec94defd029ab8955e4f4c5d3fdd3a2fc2bccf4d87c4dcaeb95665f4452","correctionReason":null,"id":"4377b49938e3292656134e9a8ec6c186212bb661370f95a7d5a2ee88f4e90b53","publicationId":"28fc2f40-45de-4dcb-8ae4-0f4560e1d707","version":1,"sourceUrl":"https://arxiv.org/abs/2611.09348","sourceTitle":"When Feedback Becomes a Backdoor: Tracing Backdoor Skill Formation in Text-Space Skill Optimization","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-06","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-09T05:07:16.458Z","createdAt":"2026-11-12T21:32:06.030Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"abcc2ec94defd029ab8955e4f4c5d3fdd3a2fc2bccf4d87c4dcaeb95665f4452","kind":"article","url":"https://arxiv.org/abs/2611.09348","sourceUrl":"https://arxiv.org/abs/2611.09348","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-12T21:05:23.224Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.09348","checkedAt":"2026-11-12T21:48:08.449Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v6","mediaId":"abcc2ec94defd029ab8955e4f4c5d3fdd3a2fc2bccf4d87c4dcaeb95665f4452","confidence":0.63,"provider":"typesafe","model":"jev-1.13.0","inputHash":"45e91a08a6d61e57987c3aa700eda7b30e3e26a3572a80540911cf23e5c26a59","decidedAt":"2026-11-12T21:05:25.619Z"},"provenance":{"textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observationId":"d80d78ade03055939dd278854ac5d500d573523ef530d25d4357e94eee028094","retrievedAt":"2026-11-12T21:05:22.892Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"6e1e178e-ab6f-470f-8aeb-dd28169f05f6"},"reviewer":{"model":"gpt-6-luna","runId":"26979adb-6a69-44b1-82dd-ab6bb90bc30c"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-12T21:32:06.030Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Koh, Louise Nayeong","url":null,"kind":"unknown"},{"name":"Lee, Yaechan","url":null,"kind":"unknown"},{"name":"Lee, Myeongjong","url":null,"kind":"unknown"},{"name":"Kim, Doyeon","url":null,"kind":"unknown"},{"name":"Park, Juyoung","url":null,"kind":"unknown"},{"name":"Kim, Seunggyu","url":null,"kind":"unknown"},{"name":"Kim, Inseo","url":null,"kind":"unknown"},{"name":"Jung, Chaerin","url":null,"kind":"unknown"},{"name":"Ryu, Hyogon","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Koh, Louise Nayeong","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Koh, Louise Nayeong","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Lee, Yaechan","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lee, Yaechan","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Lee, Myeongjong","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lee, Myeongjong","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Kim, Doyeon","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kim, Doyeon","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Park, Juyoung","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Park, Juyoung","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Kim, Seunggyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kim, Seunggyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:5","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Kim, Inseo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kim, Inseo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:6","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Jung, Chaerin","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Jung, Chaerin","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:7","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Ryu, Hyogon","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Ryu, Hyogon","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:8","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}}],"participationCoverage":{"total":9,"returned":9,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.09348","snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z","basis":"publisher-page-metadata","sourceLinks":48,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/4377b49938e3292656134e9a8ec6c186212bb661370f95a7d5a2ee88f4e90b53/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-paper-traces-how-poisoned-answers-shape-skills-4377b499","formats":{"html":"/readings/arxiv-cs-ai-paper-traces-how-poisoned-answers-shape-skills-4377b499","markdown":"/readings/arxiv-cs-ai-paper-traces-how-poisoned-answers-shape-skills-4377b499.md","json":"/readings/arxiv-cs-ai-paper-traces-how-poisoned-answers-shape-skills-4377b499.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-benchmark","name":"Benchmark","explanation":"A defined set of tests used to compare systems. Results depend on the tasks and measures selected.","referenceUrl":"https://arxiv.org/abs/2211.09110"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"4377b49938e3292656134e9a8ec6c186212bb661370f95a7d5a2ee88f4e90b53","revision":"28fc2f40-45de-4dcb-8ae4-0f4560e1d707","revisionKind":"publication-id","title":"arXiv cs.AI paper traces how poisoned answers shape Skills","url":"https://escapemeridian.com/readings/arxiv-cs-ai-paper-traces-how-poisoned-answers-shape-skills-4377b499"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.09348","revision":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","revisionKind":"sha256-source-text","title":"When Feedback Becomes a Backdoor: Tracing Backdoor Skill Formation in Text-Space Skill Optimization","url":"https://arxiv.org/abs/2611.09348"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"4377b49938e3292656134e9a8ec6c186212bb661370f95a7d5a2ee88f4e90b53","title":"arXiv cs.AI paper traces how poisoned answers shape Skills","argument":"The authors of “When Feedback Becomes a Backdoor” study whether poisoned reference answers can shape Skills: reusable text artifacts that guide future agent behavior. They report that an attacker can induce a persistent trigger-conditioned rule without access to the model, optimizer, or Skill file. In SearchQA, where the payload replaces a short answer, the natural attack retained an exact rule in all three seeds; the final Skill emitted it on every triggered question and none of the clean questions. In SpreadsheetBench, where the payload required a workbook edit, no natural run retained an exact rule across three seeds. The authors’ diagnostic interventions locate two bottlenecks there: the Analyst abstracts away required literals, and edit-budget ranking can remove exact edits before candidate construction. Their results distinguish exposure to poisoned feedback from a backdoor actually forming and persisting: exposure alone does not ensure the rule is formed, selected, and retained. The different benchmark outcomes leave open what makes a poisoned rule survive when its payload requires more than replacing a short answer.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The findings described here concern SearchQA and SpreadsheetBench; the abstract does not establish how the results extend to other tasks. The reported comparison of clean accuracy to benign SkillOpt is for seed 42 only. The source describes three seeds for the natural attacks, but the abstract does not give further detail on experimental variability.","speaker":{"name":"Koh, Louise Nayeong, Lee, Yaechan, Lee, Myeongjong, Kim, Doyeon, Park, Juyoung, Kim, Seunggyu, Kim, Inseo, Jung, Chaerin, Ryu, Hyogon","roleAtSource":"Article author"},"source":{"title":"When Feedback Becomes a Backdoor: Tracing Backdoor Skill Formation in Text-Space Skill Optimization","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.09348","publishedAt":"2026-11-06","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors describe Skills as reusable text artifacts that guide future agent behavior, and study poisoning reference answers used as supervision in text-space Skill optimization.","excerpt":"Reference answers are a supervision channel in text-space Skill optimization, which produces reusable text artifacts called Skills that guide future agent behavior.","url":"https://arxiv.org/abs/2611.09348","relationship":"Source-stated"},{"text":"The authors report that poisoned answers can induce a persistent trigger-conditioned rule without attacker access to the model, optimizer, or Skill file.","excerpt":"Poisoning those answers can induce a persistent trigger-conditioned rule without giving the attacker access to the model, optimizer, or Skill file.","url":"https://arxiv.org/abs/2611.09348","relationship":"Source-stated"},{"text":"In SearchQA, the natural attack retained an exact rule in all three seeds; each final Skill emitted the payload on all triggered questions and none of the clean questions.","excerpt":"the natural attack retains an exact rule in all three seeds; each final Skill emits the payload on 200/200 triggered questions and 0/200 clean questions.","url":"https://arxiv.org/abs/2611.09348","relationship":"Source-stated"},{"text":"In SpreadsheetBench, no natural run retained an exact rule across three seeds; diagnostic interventions identify abstraction of required literals and edit-budget ranking as successive bottlenecks.","excerpt":"In SpreadsheetBench, where the payload requires an additional workbook edit, no natural run retains an exact rule across three seeds. Diagnostic interventions locate two successive bottlenecks","url":"https://arxiv.org/abs/2611.09348","relationship":"Source-stated"},{"text":"The authors conclude that poisoned references do not guarantee a backdoor rule will form, be selected, and persist.","excerpt":"Poisoned references can therefore create persistent backdoors, but exposure alone does not ensure that the induced rule is formed, selected, and retained.","url":"https://arxiv.org/abs/2611.09348","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.09348","checkedAt":"2026-11-12T21:48:08.449Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"What makes a poisoned rule survive SkillOpt when its payload requires more than replacing a short answer?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI paper traces how poisoned answers shape Skills","summary":"The authors of “When Feedback Becomes a Backdoor” study whether poisoned reference answers can shape Skills: reusable text artifacts that guide future agent behavior. They report that an attacker can induce a persistent trigger-conditioned rule without access to the model, optimizer, or Skill file. In SearchQA, where the payload replaces a short answer, the natural attack retained an exact rule in all three seeds; the final Skill emitted it on every triggered question and none of the clean questions. In SpreadsheetBench, where the payload required a workbook edit, no natural run retained an exact rule across three seeds. The authors’ diagnostic interventions locate two bottlenecks there: the Analyst abstracts away required literals, and edit-budget ranking can remove exact edits before candidate construction. Their results distinguish exposure to poisoned feedback from a backdoor actually forming and persisting: exposure alone does not ensure the rule is formed, selected, and retained. The different benchmark outcomes leave open what makes a poisoned rule survive when its payload requires more than replacing a short answer.","question":"What makes a poisoned rule survive SkillOpt when its payload requires more than replacing a short answer?","claims":[{"text":"The authors describe Skills as reusable text artifacts that guide future agent behavior, and study poisoning reference answers used as supervision in text-space Skill optimization.","excerpt":"Reference answers are a supervision channel in text-space Skill optimization, which produces reusable text artifacts called Skills that guide future agent behavior.","support":"source-stated"},{"text":"The authors report that poisoned answers can induce a persistent trigger-conditioned rule without attacker access to the model, optimizer, or Skill file.","excerpt":"Poisoning those answers can induce a persistent trigger-conditioned rule without giving the attacker access to the model, optimizer, or Skill file.","support":"source-stated"},{"text":"In SearchQA, the natural attack retained an exact rule in all three seeds; each final Skill emitted the payload on all triggered questions and none of the clean questions.","excerpt":"the natural attack retains an exact rule in all three seeds; each final Skill emits the payload on 200/200 triggered questions and 0/200 clean questions.","support":"source-stated"},{"text":"In SpreadsheetBench, no natural run retained an exact rule across three seeds; diagnostic interventions identify abstraction of required literals and edit-budget ranking as successive bottlenecks.","excerpt":"In SpreadsheetBench, where the payload requires an additional workbook edit, no natural run retains an exact rule across three seeds. Diagnostic interventions locate two successive bottlenecks","support":"source-stated"},{"text":"The authors conclude that poisoned references do not guarantee a backdoor rule will form, be selected, and persist.","excerpt":"Poisoned references can therefore create persistent backdoors, but exposure alone does not ensure that the induced rule is formed, selected, and retained.","support":"source-stated"}],"limitations":["The findings described here concern SearchQA and SpreadsheetBench; the abstract does not establish how the results extend to other tasks.","The reported comparison of clean accuracy to benign SkillOpt is for seed 42 only.","The source describes three seeds for the natural attacks, but the abstract does not give further detail on experimental variability."],"mediaId":"abcc2ec94defd029ab8955e4f4c5d3fdd3a2fc2bccf4d87c4dcaeb95665f4452","correctionReason":null,"id":"4377b49938e3292656134e9a8ec6c186212bb661370f95a7d5a2ee88f4e90b53","publicationId":"28fc2f40-45de-4dcb-8ae4-0f4560e1d707","version":1,"sourceUrl":"https://arxiv.org/abs/2611.09348","sourceTitle":"When Feedback Becomes a Backdoor: Tracing Backdoor Skill Formation in Text-Space Skill Optimization","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-06","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-09T05:07:16.458Z","createdAt":"2026-11-12T21:32:06.030Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"abcc2ec94defd029ab8955e4f4c5d3fdd3a2fc2bccf4d87c4dcaeb95665f4452","kind":"article","url":"https://arxiv.org/abs/2611.09348","sourceUrl":"https://arxiv.org/abs/2611.09348","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-12T21:05:23.224Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.09348","checkedAt":"2026-11-12T21:48:08.449Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v6","mediaId":"abcc2ec94defd029ab8955e4f4c5d3fdd3a2fc2bccf4d87c4dcaeb95665f4452","confidence":0.63,"provider":"typesafe","model":"jev-1.13.0","inputHash":"45e91a08a6d61e57987c3aa700eda7b30e3e26a3572a80540911cf23e5c26a59","decidedAt":"2026-11-12T21:05:25.619Z"},"provenance":{"textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observationId":"d80d78ade03055939dd278854ac5d500d573523ef530d25d4357e94eee028094","retrievedAt":"2026-11-12T21:05:22.892Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"6e1e178e-ab6f-470f-8aeb-dd28169f05f6"},"reviewer":{"model":"gpt-6-luna","runId":"26979adb-6a69-44b1-82dd-ab6bb90bc30c"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-12T21:32:06.030Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Koh, Louise Nayeong","url":null,"kind":"unknown"},{"name":"Lee, Yaechan","url":null,"kind":"unknown"},{"name":"Lee, Myeongjong","url":null,"kind":"unknown"},{"name":"Kim, Doyeon","url":null,"kind":"unknown"},{"name":"Park, Juyoung","url":null,"kind":"unknown"},{"name":"Kim, Seunggyu","url":null,"kind":"unknown"},{"name":"Kim, Inseo","url":null,"kind":"unknown"},{"name":"Jung, Chaerin","url":null,"kind":"unknown"},{"name":"Ryu, Hyogon","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Koh, Louise Nayeong","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Koh, Louise Nayeong","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Lee, Yaechan","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lee, Yaechan","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Lee, Myeongjong","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lee, Myeongjong","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Kim, Doyeon","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kim, Doyeon","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Park, Juyoung","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Park, Juyoung","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Kim, Seunggyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kim, Seunggyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:5","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Kim, Inseo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kim, Inseo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:6","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Jung, Chaerin","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Jung, Chaerin","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:7","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}},{"actor":{"name":"Ryu, Hyogon","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Ryu, Hyogon","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09348","locator":"head/meta[name=author|citation_author]"},"assertionId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d:participation:8","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T21:48:08.449Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","sourceUrl":"https://arxiv.org/abs/2611.09348","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z"}}],"participationCoverage":{"total":9,"returned":9,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.09348","snapshotId":"f7371e00646f299189559da3241fd83eff2f3d01d450dcb952f5af09f174fd6d","contentSha256":"e26235b8cdf85339cf8c3c6e70e6580e5e568ae7b095883632812e22b84a8474","textHash":"081247c02195d4aed7a69c79de1b8ef0431e61715d55b10f9a221b1a09b680ba","observedAt":"2026-11-12T21:48:08.449Z","basis":"publisher-page-metadata","sourceLinks":48,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/4377b49938e3292656134e9a8ec6c186212bb661370f95a7d5a2ee88f4e90b53/source"}}}],"audits":[{"publicationId":"28fc2f40-45de-4dcb-8ae4-0f4560e1d707","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The findings are attributed to the authors of the named arXiv paper. The title calls it an arXiv cs.AI paper. Its primary listing is cs.CR, but it is cross-listed in cs.AI, so the label is not wrong. No claims are misassigned.","excerpt":"Subjects:\nCryptography and Security (cs.CR); Artificial Intelligence (cs.AI)"},{"dimension":"summary","status":"uncertain","explanation":"The summary follows the abstract closely, but several central terms are left unexplained for a non-specialist: backdoor, trigger-conditioned rule, payload, seeds, the Analyst, literals and edit-budget ranking. The question names SkillOpt, which the summary never introduces as the system studied. The summary also drops two details. One is the condition that the edit-budget bottleneck appears once literal preservation is enabled. The other is the seed 42 result that removing the rule eliminates activation. Smallest repair: briefly gloss these terms, introduce SkillOpt, and restore the literal-preservation condition.","excerpt":"once literal preservation is enabled, edit-budget ranking can remove exact edits before candidate construction"},{"dimension":"date","status":"pass","explanation":"The originalPublished date of 2026-11-06 matches the v1 submission date in the evidence. It is not the feed date of 2026-11-09.","excerpt":"[Submitted on 6 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"Each claim matches its verbatim abstract excerpt. The limitations accurately reflect the abstract's stated scope: two benchmarks, three seeds, and a seed 42 clean-accuracy comparison. The question follows from the contrasting results and does not assume an answer. The draft adds no unsupported benefits, costs or forecasts.","excerpt":"Poisoned references can therefore create persistent backdoors, but exposure alone does not ensure that the induced rule is formed, selected, and retained."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the arXiv abstract page. It is the original source.","excerpt":null}],"createdAt":"2026-11-12T21:32:06.030Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}