LatentTriad screens malicious agent skills from one prefill — Prefill-state skill screening — What does it mean?

The news. On November 3, 2026, researchers from HKUST (Guangzhou), Griffith University, Wake Forest University and George Mason University posted LatentTriad. On 5,830 skill packages from five sources and seven model backbones it reports 99.0–99.2% pooled F1 and 93.0–94.6% source-macro F1, with a compact implementation finishing prefill plus detection in a median 259–284 ms. Read the paper →

Prefill-state skill screening judges an agent skill by what the model's internal state looks like after it has read the skill, but before it has done anything with it. A skill is a package the agent loads as instructions, and the attack-surface step explains why that makes it a way in. Public skill collections are large (the paper cites SkillsMP indexing over 3.18 million public SKILL.md files), so checking each one by hand is not an option.

Back at the customs desk. The officer holds the traveler's trip purpose (the trusted task), a declaration form and a bag. A keyword scanner is an officer who only looks for banned words on the form. A sandbox is an officer who unpacks the bag and test-uses every item, which the paper puts at about 153 seconds per skill for one sandbox detector, SkillDetonate. Risk is also relative to the trip: a file upload is normal for a backup task and an attack for a spreadsheet task. LatentTriad is the officer with a trained first impression: after one look at the task, the form and the bag together, the model's own internal state already carries a readable signal about whether the contents fit the stated purpose. The authors' first finding is exactly this, and it holds for expression forms the readout was not trained on in their controlled tests.

The detector writes the trusted task, the tool schema and the readable files of the skill package into one prompt, runs the model's prefill once, and keeps hidden states at eight fixed relative depths. Three readouts reuse those same tensors, so nothing is generated and no skill code runs:

• Boundary reads the end-of-context state, the model's summary of the whole situation: task plus skill.
• Operation takes the states over the skill's operational text (the rest of SKILL.md plus scripts and config), removes directions that only separate skill families by style, and projects what is left onto learned risk directions.
• Geometry learns, from benign packages only, how the declared purpose predicts the operations and how the operations predict the context. It then measures how far a new package departs from those learned relations (observed minus predicted).

In the customs picture, Boundary is the officer's overall unease, Operation is an eye for items that look like contraband, and Geometry is noticing that this declaration, this bag and this trip do not belong together. A fixed rule joins the three probabilities: s = max(pB, min(pO, pG)), and the skill is blocked when s is at least 0.5. Boundary alone is enough to block, but an Operation alert needs Geometry to agree.

A readout could be reading a style cue instead of the operation, so the authors test influence directly. They replace the Operation states with those of a matched donor that differs only in the operation. The frozen diagnostic logits move toward the donor's label by 2.376–2.909 across three backbones, and the later Boundary state moves too: median normalized recovery is 0.592 on Llama and 0.944 on Qwen. So the operation tokens do not just correlate with risk; they change what the model's summary state says afterwards. That is the reason the paper keeps an operation-level readout next to the whole-context one.

Worked example (arithmetic on the reported numbers). Suppose a team must screen 1,000 incoming skills. At about 153 s each, sandbox detonation takes 153,000 s, roughly 42.5 hours back to back. At the compact detector's slowest reported median, 284 ms, the same 1,000 skills take 284 s, about 4.7 minutes, which is roughly 540 times less time. Two cautions: the two figures come from different setups, and only the compact variant was timed (it adds 56–65 ms to the prefill); the paper says the full detector's runtime was not measured and should not be extrapolated.

Now the gate, with illustrative probabilities. A skill with pB = 0.30, pO = 0.80 and pG = 0.70 gets s = max(0.30, min(0.80, 0.70)) = 0.70, so it is blocked. The same skill with pG = 0.20 gets s = max(0.30, 0.20) = 0.30, so it passes: a high Operation score alone cannot block (illustrative).

The headline numbers are strong inside a known ecosystem and weaker outside it. Pooled F1 is 99.0–99.2%, but 89.9% of the benign packages come from one source, which is why the paper also reports source-macro F1. Pooled false-positive rate is 1.1–1.4%; weighting sources equally it is 8.0–11.2%. When a whole source is held out of training, mean source-macro F1 falls to 73.2%, still above RouteGuard and AgentLens on all seven backbones.

Some limits the authors report themselves. On a synthetic test with permuted symbol assignments, AUROC drops to 49.25–53.47%, near chance, so the results do not show general reasoning about cross-file structure. Against a white-box attacker who splits a payload across files, attack success was 11.0% on Llama, but those rewrites also raised benign false positives on that panel's eligible subset from 32.3–40.8% to 49.3–80.4%. Geometry alone (95.85% F1, no observed false positives) beat the full fused rule (93.91%), so the fixed gate is not the best policy on the reported metrics. And because the readout depends on hidden states, it needs a model whose internals you can read, and it is tied to the exact prompt format it was fitted on: changing the serializer, chat template or tool schema can change a package's representation.

Where it sits in an agent harness: it runs after the package is in the model's context and before the model generates a token, selects a tool or causes a side effect, so it is closest in spirit to the input-filter layer of a defense-in-depth stack. It does not replace the checks that come later. ActionGuard, covered in reviewer isolation, judges each tool call at execution time; LatentTriad judges the package before any call. The authors frame screening as a complement to permission enforcement and runtime monitoring, not a substitute.

Goes deeper in: AI Agents → Tool Use & Function Calling → Skills as a Primitive

Related explainers

• ActionGuard — Reviewer isolation from poisoned skill text — the execution-time check that complements a pre-load screen.
• EvoMal — how a planted payload spreads into skills an agent writes itself.
• AgentDoG 1.5 — small inline guard models for agent actions.
• Activation probes on agents — another use of hidden-state probes for agent safety.