{"id":"5c9bb51e-1193-43f2-8f72-0c47b02240ed","arxiv_id":"2608.03700","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Persona-skill distillation reliably preserves private attributes and communication style across agents and methods, and current defenses fail to fully suppress them.","lead":"This paper introduces AntiSkillBench, a benchmark that measures how much privacy and personal style leak when AI agents distill chat histories into reusable persona skills. It finds leakage persists across three agents and three distillation methods, and that existing defenses only partially suppress it.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Benchmark's forced-reflection traces pre-load persona signals (each key characteristic in ≥5 of 50 prompts), so the 'structural persistence' claim may not transfer to real logs; a sparse-trace re-run would settle it.","rationale":"The reader's weakest_assumption identifies the same load-bearing concern: the synthetic trace construction builds leakage into the evaluation through reflection rules that force every key characteristic into at least 5 of 50 prompts. My analysis converges on this point and adds two specifications. First, the App. E.1 ablation shows a monotone relationship between dialogue quantity and measured leakage, which supports a signal-frequency explanation rather than a purely structural one. Second, the paper's own Sec. 5.2 language—'structural consequences'—makes the external-validity question central to the headline claim. The concern is not that the benchmark is useless; it is that the quantitative risk rates and the 'persists across implementations' conclusion are conditional on an unvalidated, deliberately disclosure-heavy trace distribution. The proposed sparse-trace ablation directly tests whether the reported leakage survives when persona signals are no longer pre-loaded. This does not change the reader's CONDITIONAL verdict: the issue is addressable and the benchmark framework remains valuable, but the paper should either soften the structural claim or provide evidence from more naturalistic traces before acceptance.","tokens_in":24208,"tokens_out":5882,"duration_ms":70266,"concrete_test":"Using the same profiles and evaluation code, generate a second trace set with realistic signal density: keep 50 traces per user but let each key characteristic appear in only 1–2 prompts instead of ≥5, and make 30–50% of traces task-only with no persona cues. Re-run the full Table 1 evaluation under this sparse condition. If communication Skill Coverage drops from ~90% to below ~50% or VocabGain becomes non-positive on several dimensions, the 'persistent, structural' claim is an artifact of forced reflection density rather than a robust property of persona-skill distillation. A complementary check is to run the same pipeline on real user traces with known ground-truth attributes; comparable leakage rates would resolve the concern.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central interpretive claim—that persona-skill risks are 'structural consequences of compiling personal traces into executable artifacts' (Sec. 5.2)—rests on traces whose signal density is artificially high. Sec. 4.1 and Template 1 in App. A.2 require 'each key characteristic must be implicitly reflected in at least 5 prompts' among only 50 prompts, and further force topic and phrasing to reflect age, gender, education, birthplace, and language style. Thus every profile dimension is repeated, consistent, and easy to extract across the input to distillation. The App. E.1 ablation shows leakage tracks signal quantity: Skill Coverage rises from 50.0 to 63.3 and QA Acc from 50.0 to 56.4 as dialogue usage rises from 10% to 100%. This is exactly what one would expect if the measured leakage is driven by how densely the synthetic traces encode Pu, not by something inherent to trace-to-skill compilation. No real-log validation is provided, and App. G postpones release of data/code. The benchmark numbers are internally coherent, but their external validity—the step from 'risks persist in AntiSkillBench' to 'persona-skill pipelines introduce persistent risks'—is the load-bearing assumption and it is not yet supported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"AntiSkillBench is proposed as an end-to-end benchmark for privacy leakage and impersonation risk in the persona-skill pipeline: user traces are distilled into executable persona skills, which are then equipped to downstream agents. The paper constructs 7,500 synthetic user–assistant dialogue traces from 50 persona-grounded profiles; evaluates three distillation protocols (Direct, Three-stage, Colleague) on three frontier agent backbones; and defines three metrics: Skill Coverage (static skill-level leakage), Field QA Accuracy (explicit attribute disclosure), and VocabGain (behavioral impersonation via lexical-style matching). It also evaluates four defense configurations: Privacy Sanitization, Adversarial Obfuscation, and two variants of Semantic Backdoor Injection. The central empirical claims are that persona-skill risks persist across backbones and distillation protocols, that leakage extends from explicit attributes to communication styles and personality traits, and that existing defenses offer only partial, distillation-dependent protection. The authors interpret the persistence as evidence that these risks are structural consequences of compiling personal traces into executable artifacts.","tokens_in":24559,"tokens_out":2989,"duration_ms":33977,"significance":"The paper addresses a timely and under-studied problem: the distillation of personal interaction histories into reusable, executable artifacts creates a distinct privacy surface relative to retrieval-based memory or direct-context personalization. The benchmark design is internally coherent: the three metrics are complementary, the two-level risk formulation (artifact-level and agent-level) is sensible, the defense taxonomy (online/post-hoc, active/passive) is useful, and the cost and ablation analyses show care. If the results transfer to realistic settings, the main finding—that communication style and personality signals are strongly retained and can be acted upon, and that existing defenses suppress surface cues but leave deeper persona information—would be an important result for the agent-safety community. The paper also makes a falsifiable prediction: leakage scales with trace signal density, which the ablation in Fig. 5(a) supports. However, the external validity of the benchmark is the load-bearing assumption, and the current evidence does not fully establish it.","major_comments":[{"comment":"The trace-generation protocol deliberately plants persona signals: Template 1 requires 'each key characteristic must be implicitly reflected in at least 5 prompts' and imposes reflection rules requiring topic and phrasing to reflect demographics, background, personality, and language style. With only 50 prompts per profile, every evaluated property is repeated, consistent, and easy to extract. Skill Coverage and QA Acc therefore partly measure retrieval of deliberately inserted cues. The ablation in App. E.1 (Fig. 5(a)) shows exactly this dependence: Skill Coverage rises from 50.0 to 63.3 and QA Acc from 50.0 to 56.4 as dialogue usage grows from 10% to 100%. This pattern is consistent with leakage being driven by trace signal density, not by something inherent to trace-to-skill compilation. Consequently, the 'structural consequences' claim in Sec. 5.2 is not yet supported. A sparse-trace","section":"Sec. 4.1 / Template 1 (Fig. 2)"},{"comment":"All experimental configurations are executed once without fixed generation seeds, and the paper reports no standard deviations, confidence intervals, or significance tests. Since the central claims compare distillation protocols and defenses (e.g., Table 1 differences between 55.2 and 63.6 Skill Coverage; Table 2 ASR-S differences between 40.0 and 100.0), it is impossible to tell whether observed differences reflect stable effects or sampling noise. The authors state that aggregating over 50 characters reduces sensitivity, but without per-character variance or repeated runs, the reported point estimates are insufficient. Please report seed-controlled runs, per-character variability, and appropriate statistical tests for the main comparisons.","section":"App. F"},{"comment":"All automatic metrics (Skill Coverage, QA Acc, ASR-S, ASR-B) rely exclusively on GPT-5.4 as the LLM judge, and no human validation or agreement statistics are reported. GPT-5.4 is also one of the evaluated agent backbones and one of the distillation models, creating a risk of systematic judge bias. The paper should validate the judge against human annotations on a sample, report per-metric agreement, and ideally use a separate judge model. This is not a theoretical issue: if the judge over-attributes persona properties to skill artifacts, all coverage and ASR numbers are inflated.","section":"Sec. 5.1 / App. D"},{"comment":"The abstract and Sec. 1 claim that defenses are evaluated across 'three frontier agents,' but the main defense table (Table 2) covers only GPT 5.4, and the appendix (Table 7) adds only Claude Haiku 4.5. No Gemini defense results are reported. The claim that 'existing defenses exhibit limited and distillation-dependent effectiveness' is therefore established for only two backbones, and the cross-agent generalization of the defense conclusions is unsupported. Please provide the missing defense runs for all three backbones or restrict the claim accordingly.","section":"Tables 2 and 7"},{"comment":"VocabGain depends on several implementation choices that are not stress-tested: the cosine threshold tau = 0.75, the oracle-gap exclusion rule (r_O - r_C <= 0), the low-expectation cutoff (r_O < 0.1), and the zero-filling of invalid categories. These choices can materially change the reported gains, especially for categories with weak oracle signals. Since VocabGain is one of the three headline metrics and is used to support the impersonation claim, a sensitivity analysis over tau and the exclusion thresholds is needed.","section":"App. D.3, Eq. (8)"}],"minor_comments":[{"comment":"Reference 'Antropic. 2025' is a typo for 'Anthropic.' Please correct throughout the bibliography.","section":"References"},{"comment":"The data and code are only promised 'upon formal publication.' For a benchmark paper, public availability of the construction prompts, distillation code, and evaluation scripts is central to reproducibility. Please consider releasing these artifacts with the preprint or at least providing a hosted demo.","section":"App. G"},{"comment":"The pipeline diagram is dense and some arrows are hard to follow, especially the distinction between online and post-hoc defense interventions. A cleaner separation of the two defense stages would improve readability.","section":"Fig. 1"}],"recommendation":"major_revision","confidential_remarks":"The benchmark has clear value and the internal pipeline is well thought out, but the current manuscript's central interpretive claim—that persona-skill risks are structural—rests on synthetic traces with deliberately dense persona signals. The authors should be encouraged to add a naturalistic or sparse-trace condition, human-validated judges, and variance-aware reporting. The manuscript also overstates the defense coverage relative to what is presented. I do not see a fundamental flaw that would require rejection, but the load-bearing points need to be strengthened before the paper can be accepted."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague — this is the first benchmark that treats persona-skill distillation as a pipeline (traces → skill artifact → equipped agent), and that alone is worth something. Prior work looks at retrieval, memory, prompting, or fine-tuning; none examine portable skill artifacts. The three distillation protocols (Direct, Three-stage, Colleague) and the defense suite (PS, ADV, SBD) are sensible, and the agent-level metrics — Field QA and VocabGain — are a real attempt to distinguish attribute disclosure from behavioral impersonation. The main numbers are internally coherent: communication style leaks at 85–92% coverage across backbones, while demographics leak far less, and the defense results show a consistent pattern that Online PS suppresses surface style but leaves personality/background behind. I buy the benchmark as a useful stress test.\n\nThe soft spots are real, though. The stress-test note is right: the trace generation rules in Sec. 4.1 and Template 1 require each key characteristic to appear implicitly in at least 5 of 50 prompts, and require topic and phrasing to reflect the profile. So the evaluation is partly a retrieval test — the signal is inserted densely and consistently, then detected after distillation. The ablation in Fig. 5a makes this concrete: Skill Coverage rises from 50 to 63.3 and QA Acc from 50 to 56.4 as dialogue usage goes from 10% to 100%. That is exactly what you'd expect if leakage scales with signal density rather than some structural property of trace-to-skill compilation. The paper's headline interpretation — 'structural consequences of compiling personal traces into executable artifacts' (Sec 5.2) — goes beyond the evidence. A sparse-trace or real-log re-run would settle it.\n\nAlso: no error bars or seed control (App F says seeds were not fixed), each configuration run once, the LLM judge is not validated against human labels, and data/code are deferred to publication (App G). These are fixable but they matter for a benchmark whose purpose is reuse. None of this kills the paper; it makes the current version a conditional rather than definitive result.\n\nWho it's for: people building personalized agents, and the safety/privacy community trying to benchmark a new attack surface. I'd give it a serious referee. The novelty is clear, the problem is well-framed, and the pipeline is the right object of study. My recommendation: send it out, ask for sparse/reduced-density traces or a real-log sanity check, error bars, judge validation, and softened claims about structural inevitability.","headline":"First real benchmark for persona-skill privacy, but the 'structural persistence' claim needs sparse-trace or real-log evidence before it convinces.","tokens_in":24993,"tokens_out":2164,"would_cite":true,"duration_ms":21907,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Persona skills leak private traits, communication style, and background across three frontier agents.","keywords":["persona skills","privacy leakage","impersonation risk","LLM agents","skill distillation","benchmark","backdoor defense","communication style"],"falsifier":"Take a corpus of real, consenting volunteer assistant chats with known attribute and style labels, run the same three distillation protocols, and measure Skill Coverage, QA Accuracy, and VocabGain. If distilled skills from real logs recover user attributes and phrasing at rates substantially below the benchmark's 60–92% communication range, the central 'risks persist structurally' claim would not transfer to realistic histories.","tokens_in":24174,"feed_emoji":"🕵️","tokens_out":6603,"duration_ms":62241,"temperature":0.7,"pith_summary":"The paper claims that turning a person's conversation history into a reusable 'persona skill' reliably encodes not just facts about that person but also how they talk, decide, and come across—and that these signals survive when the skill is loaded into a downstream agent. It introduces AntiSkillBench, a benchmark of 7,500 simulated persona-grounded dialogues across 50 profiles, to measure skill-level privacy leakage and agent-level impersonation under three distillation protocols. Across three frontier agent backbones, communication style is the most persistent leak (88–92% coverage in skill artifacts), and existing defenses only partly suppress it while leaving personality and background exposed. The authors argue these risks are structural consequences of compiling personal traces into executable artifacts, which matters because persona skills are positioned as portable, reusable personalization—so the safety problem travels with the artifact rather than staying with the original logs.","feed_headline":"Persona skills leak users' voice, traits, and background","feed_subtitle":"Across 7,500 simulated dialogues, communication style survives distillation and current defenses barely weaken it.","key_machinery":"The central object is the persona-skill pipeline: user traces distilled into an executable persona skill artifact that equips a downstream agent. Its load-bearing property is risk concentration: distillation re-encodes fragmented personal signals from many dialogues into a single compact artifact that can be inspected, transferred, and reused across agents, so leakage is evaluated both statically in the artifact and behaviorally in the equipped agent. The benchmark operationalizes this with three metrics—Skill Coverage, Field QA Accuracy, and VocabGain—and a defense suite spanning active interventions (privacy sanitization, adversarial obfuscation) and passive provenance protection (semantic","core_discovery":"To test whether compiling a person's interaction history into a reusable, executable persona skill creates new privacy and impersonation risks, the paper builds AntiSkillBench: 7,500 multi-turn persona-grounded dialogues from 50 enriched profiles, three skill-distillation protocols (one-step direct distillation, a structured three-stage distillation, and a colleague-style persona pipeline), and metrics at two levels. Skill Coverage measures how much of the target user's profile survives into the distilled skill artifact; Field QA Accuracy measures whether a skill-equipped agent answers direct attribute questions as the user; VocabGain measures whether the agent reproduces the user's vocabula","pith_inferences":["Editorial inference: the same concentration property that makes persona skills riskier also makes them easier to audit—a distilled artifact is a single point where privacy review could be applied, so inspecting and redacting the skill artifact itself before deployment is a natural testable defense.","Editorial inference: because the synthetic traces are explicitly crafted so each key trait appears in at least five prompts, real-world leakage rates are likely lower; re-running the benchmark on real, sparser logs with independently labelled attributes would calibrate how much of the reported 88–92% communication coverage transfers to practice.","Editorial inference: the paper's impersonation metrics could double as an evaluation of fraud risk—an agent that reproduces a user's phrasing in user-specific scenarios is precisely the capability needed to script phishing messages or fake authorizations, so the benchmark could be repurposed as a red-team tool for authentic-agent systems."],"forward_implications":["If persona skills are deployed in products, a leaked skill artifact is a compact dossier: an attacker with access to the skill can extract demographics, background, personality, and style without touching the original chat logs.","The persistence of leakage across three distillation protocols means changing the distillation recipe alone will not secure persona skills; defenses must intervene at trace collection, artifact design, and downstream behavior jointly.","Because communication style is the most recoverable dimension, impersonation risk is not limited to revealing facts—agents can produce text that is attributable to the user, which raises the stakes for fraud and forged authorization.","Backdoor provenance protection is distillation-dependent: it works when distilled skills preserve surface cues, but persona-centric distillation can absorb the backdoor as a personality trait and render it inactive."],"supporting_citations":[{"why":"Supplies the 50 base user profiles (demographics, background, personality) that AntiSkillBench enriches with Big Five traits and communication style.","marker":"Wang et al. 2025a"},{"why":"Provides the COLLEAGUE.SKILL-style persona distillation pipeline used as the Colleague Distill baseline, central to the cross-protocol persistence claim.","marker":"Zhou et al. 2026"},{"why":"Provides the embedding-based soft matching used in the VocabGain metric to credit semantically close style markers.","marker":"Reimers and Gurevych 2019"},{"why":"Defines the retrieval-based memory privacy setting that persona skills are contrasted with, motivating the benchmark's focus on distillation.","marker":"Mukhopadhyay et al. 2025"},{"why":"Prior individual-level impersonation benchmark that AntiSkillBench's agent-level impersonation metrics are situated against.","marker":"Shi et al. 2025"}],"fun_headline_variants":["Persona skills can hand over your voice and traits","Persona skills leak more than you think","Distilling your chats into AI leaks your style","Persona skills: your personality, easily copied","Benchmark shows persona skills leak identity"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The benchmark's realism depends on LLM-simulated dialogues that deliberately encode each persona trait many times; real interaction logs are likely sparser and less style-consistent, so the high leakage rates may overstate how much of a real user's voice survives distillation.","fun_headline_variants_meta":{"raw":{"variants":["Persona skills can hand over your voice and traits","Persona skills leak more than you think","Distilling your chats into AI leaks your style","Persona skills: your personality, easily copied","Benchmark shows persona skills leak identity"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000228,"raw_usage":{"total_tokens":1308,"prompt_tokens":734,"completion_tokens":574,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":478,"completion_tokens_details":{"reasoning_tokens":505}},"tokens_in":478,"tokens_out":574,"duration_ms":5860,"temperature":1.0,"reasoning_tokens":505,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T14:26:11.882783+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a corpus of real, consenting volunteer assistant chats with known attribute and style labels, run the same three distillation protocols, and measure Skill Coverage, QA Accuracy, and VocabGain. If distilled skills from real logs recover user attributes and phrasing at rates substantially below the benchmark's 60–92% communication range, the central 'risks persist structurally' claim would not transfer to realistic histories.","supporting_citations":[],"review_version":1}