arXiv subjects

Tu Lan

Publications and source records attributed to Tu Lan.

6 recordsLinked to original sources

arXiv2026

Runtime Skill Audit: Targeted Runtime Probing for Agent Skill Security

Agent skills let LLM agents reuse instructions, resources, tools, and workflows, but they also create a new place for malicious behavior to hide. A skill may look benign in its documentation or code while becoming harmful only when it is invoked with particular user requests, local assets, persistent state, or multi-step tool interactions. This makes purely static vetting brittle. We present Runtime Skill Audit (RSA), a dynamic analysis method that audits skills by asking what the skill-mediated agent actually does under targeted runtime conditions. Instead of testing every skill with the same generic tasks, RSA profiles risk-relevant interfaces, prepares the execution context needed to exercise them, and assigns security labels from the resulting trace evidence. We instantiate RSA on OpenClaw and evaluate it on 100 skills against representative static baselines. RSA achieves 90.0\% accuracy with an 88.0\% true positive rate and an 8.0\% false positive rate, improving accuracy by 13.0 percentage points over the best static baseline. Under self-evolving attacks, static detectors collapse after one or two rounds, while RSA continues to detect 19--20 out of 20 malicious skills across rounds.

cs.CR↗

arXiv2026

Trojan's Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidance

Autonomous coding agents are increasingly integrated into software development workflows, offering capabilities that extend beyond code suggestion to active system interaction and environment management. OpenClaw, a representative platform in this emerging paradigm, introduces an extensible skill ecosystem that allows third-party developers to inject behavioral guidance through lifecycle hooks during agent initialization. While this design enhances automation and customization, it also opens a novel and unexplored attack surface. In this paper, we identify and systematically characterize guidance injection, a stealthy attack vector that embeds adversarial operational narratives into bootstrap guidance files. Unlike traditional prompt injection, which relies on explicit malicious instructions, guidance injection manipulates the agent's reasoning context by framing harmful actions as routine best practices. These narratives are automatically incorporated into the agent's interpretive framework and influence future task execution without raising suspicion.We construct 26 malicious skills spanning 13 attack categories including credential exfiltration, workspace destruction, privilege escalation, and persistent backdoor installation. We evaluate them using ORE-Bench, a realistic developer workspace benchmark we developed. Across 52 natural user prompts and six state-of-the-art LLM backends, our attacks achieve success rates from 16.0% to 64.2%, with the majority of malicious actions executed autonomously without user confirmation. Furthermore, 94% of our malicious skills evade detection by existing static and LLM-based scanners. Our findings reveal fundamental tensions in the design of autonomous agent ecosystems and underscore the urgent need for defenses based on capability isolation, runtime policy enforcement, and transparent guidance provenance.

cs.CR↗

arXiv2026

SlowBA: An efficiency backdoor attack towards VLM-based GUI agents

Modern vision-language-model (VLM) based graphical user interface (GUI) agents are expected not only to execute actions accurately but also to respond to user instructions with low latency. While existing research on GUI-agent security mainly focuses on manipulating action correctness, the security risks related to response efficiency remain largely unexplored. In this paper, we introduce SlowBA, a novel backdoor attack that targets the responsiveness of VLM-based GUI agents. The key idea is to manipulate response latency by inducing excessively long reasoning chains under specific trigger patterns. To achieve this, we propose a two-stage reward-level backdoor injection (RBI) strategy that first aligns the long-response format and then learns trigger-aware activation through reinforcement learning. In addition, we design realistic pop-up windows as triggers that naturally appear in GUI environments, improving the stealthiness of the attack. Extensive experiments across multiple datasets and baselines demonstrate that SlowBA can significantly increase response length and latency while largely preserving task accuracy. The attack remains effective even with a small poisoning ratio and under several defense settings. These findings reveal a previously overlooked security vulnerability in GUI agents and highlight the need for defenses that consider both action correctness and response efficiency. Code can be found in https://github.com/tu-tuing/SlowBA.

cs.CR↗

arXiv2020

On Training Effective Reinforcement Learning Agents for Real-time Power Grid Operation and Control

Deriving fast and effectively coordinated control actions remains a grand challenge affecting the secure and economic operation of today's large-scale power grid. This paper presents a novel artificial intelligence (AI) based methodology to achieve multi-objective real-time power grid control for real-world implementation. State-of-the-art off-policy reinforcement learning (RL) algorithm, soft actor-critic (SAC) is adopted to train AI agents with multi-thread offline training and periodic online training for regulating voltages and transmission losses without violating thermal constraints of lines. A software prototype was developed and deployed in the control center of SGCC Jiangsu Electric Power Company that interacts with their Energy Management System (EMS) every 5 minutes. Massive numerical studies using actual power grid snapshots in the real-time environment verify the effectiveness of the proposed approach. Well-trained SAC agents can learn to provide effective and subsecond control actions in regulating voltage profiles and reducing transmission losses.

math.OC↗

arXiv2020

Deriving AC OPF Solutions via Proximal Policy Optimization for Secure and Economic Grid Operation

Optimal power flow (OPF) is a very fundamental but vital optimization problem in the power system, which aims at solving a specific objective function (ex.: generator costs) while maintaining the system in the stable and safe operations. In this paper, we adopted the start-of-the-art artificial intelligence (AI) techniques to train an agent aiming at solving the AC OPF problem, where the nonlinear power balance equations are considered. The modified IEEE-14 bus system were utilized to validate the proposed approach. The testing results showed a great potential of adopting AI techniques in the power system operations.

eess.SY↗

arXiv2019

AI-Based Autonomous Line Flow Control via Topology Adjustment for Maximizing Time-Series ATCs

This paper presents a novel AI-based approach for maximizing time-series available transfer capabilities (ATCs) via autonomous topology control considering various practical constraints and uncertainties. Several AI techniques including supervised learning and deep reinforcement learning (DRL) are adopted and improved to train effective AI agents for achieving the desired performance. First, imitation learning (IL) is used to provide a good initial policy for the AI agent. Then, the agent is trained by DRL algorithms with a novel guided exploration technique, which significantly improves the training efficiency. Finally, an Early Warning (EW) mechanism is designed to help the agent find good topology control strategies for long testing periods, which helps the agent to determine action timing using power system domain knowledge; thus, effectively increases the system error-tolerance and robustness. Effectiveness of the proposed approach is demonstrated in the "2019 Learn to Run a Power Network (L2RPN)" global competition, where the developed AI agents can continuously and safely control a power grid to maximize ATCs without operator's intervention for up to 1-month's operation data and eventually won the first place in both development and final phases of the competition. The winning agent has been open-sourced on GitHub.

eess.SP↗